94336ccbc2bf47d3d53813a6a84ba5eba80f8f5d10cb145d8cf99e50e737a471

Analysis

max time kernel
19s
max time network
22s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 15:59

Target

Ace_executor.exe
Size

80.5MB
MD5

d4a4271250b540003b349e43a0d26f4c
SHA1

3bc7799e2ffb7588742633359b8cf35209bb4e76
SHA256

94336ccbc2bf47d3d53813a6a84ba5eba80f8f5d10cb145d8cf99e50e737a471
SHA512

452afb91a5177915721d117637d7da530b16e8ce94849f9e249af88cf671596b565eb1c1971af5f9ae5f78a3e936c469a87f5e9dd146506f91551365dfa614da
SSDEEP

1572864:vvxZQglwWLvZSk8IpG7V+VPhqclE7hlgkiYgj+h58sMw091b4cJzU:vvxZxqGZSkB05awcYeu5Y91bU

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1988	Ace_executor.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000001ded2-1260.dat	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1808	AUDIODG.EXE
Token: 33	1808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1808	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1988	1320	Ace_executor.exe	30
PID 1320 wrote to memory of 1988	1320	Ace_executor.exe	30
PID 1320 wrote to memory of 1988	1320	Ace_executor.exe	30

C:\Users\Admin\AppData\Local\Temp\Ace_executor.exe
"C:\Users\Admin\AppData\Local\Temp\Ace_executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\Ace_executor.exe
  "C:\Users\Admin\AppData\Local\Temp\Ace_executor.exe"
  2⤵
  - Loads dropped DLL
  PID:1988

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Users\Admin\AppData\Local\Temp\_MEI13202\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/1988-1262-0x000007FEF6760000-0x000007FEF6D49000-memory.dmp

Filesize
5.9MB

Download
memory/1988-1263-0x000007FEF6760000-0x000007FEF6D49000-memory.dmp

Filesize
5.9MB

Download