Analysis

  • max time kernel
    91s
  • max time network
    207s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/11/2024, 10:46

General

  • Target

    3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a.exe

  • Size

    93.8MB

  • MD5

    b0d3d2a9ce5ab03aeaaeab999a2a44c9

  • SHA1

    ef491fe9615162b24b79376815de27b8786782d1

  • SHA256

    3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a

  • SHA512

    2176bad4485613abdea62315986707e5136abcea07bb67a7217733dc3afee9d5c581fc85a08dff5bbd4abd58cd0fa10670ec5881a5149eaf55d0d33afcc504c9

  • SSDEEP

    1572864:imN4jGa5YUwTJZAMq8gglK8lxmRN0B9ESMjniS6:IPaPTEMqeK8DAN0B9ajj6

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 42 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a.exe
    "C:\Users\Admin\AppData\Local\Temp\3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Program Files (x86)\AVStrike\AVStrike.exe
      "C:\Program Files (x86)\AVStrike\AVStrike.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1696
  • C:\Program Files (x86)\AVStrike\AVStrike.exe
    "C:\Program Files (x86)\AVStrike\AVStrike.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:500

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\AVStrike\AVStrike.AVStrike

          Filesize

          11KB

          MD5

          973b4ec79ca6a72ebad9a71c735b5a44

          SHA1

          6c382ed8eded79585e47640313e98fe9ab5cf689

          SHA256

          efa328c8db9e1397e085c86bd8c564ff1ef0653c4351b9a5eb1b92b9e69cf262

          SHA512

          3a4646ab5dd6e7858151a141225a73b5bd0316b1a0f8f943ab35f385acdc5c6dbc248941848edad507852c30eac9e4eac6d795ed82573cf8267d51724bf9cfe5

        • C:\Program Files (x86)\AVStrike\AVStrike.exe

          Filesize

          1.0MB

          MD5

          625ceb491ee54a693bfcf4ae7338bf3e

          SHA1

          e0eca9a959fc54c6adf8cb0fe168496ae1982916

          SHA256

          55eb603c027d50a86699391522ce35c3d03c67fa5820ee3755444bb927bb18cd

          SHA512

          1a8c8a0ba6653bf6988c851ca095b80113346ec5612f1f479977aa893eb4464a7bd76b9ef0fbd34ab3754ebd99b82688aa8a95645ba680569153cb23cc39ddad

        • C:\Program Files (x86)\AVStrike\AVStrike.exe.config

          Filesize

          5KB

          MD5

          b37ea027280a6ffcda20de4e5817750d

          SHA1

          ec522027d14006f1d621b939d3e1a56d72fe6011

          SHA256

          708bf566dde3dc21eac5f192186e5e419e0ae790dacb62c2b5e0f1739d54d6e1

          SHA512

          0002bde8cdb2cfc034a4f29a8d592e03cf8e7be1a3b7e733250dc6372b14d1132ff9713a9bd1483c11c6b1a15fd809427c46c8f11a7951b559a69527c51df1bf

        • C:\Program Files (x86)\AVStrike\CButtonLib.dll

          Filesize

          98KB

          MD5

          7b3c2af71311af1d7c3ea7079853a9fc

          SHA1

          a031fb584c4b859b13d83d6d0874a2f204dbd6dd

          SHA256

          432e960a04e7e056acbebdadf1ccf436a92117d6021c4cc8a2384021f07a0688

          SHA512

          f51c58d9700766c30b7f7f60b88625eb77887a50c21dd28858d28075d35a984102d8c6fe78f28f6ae17da2a4454f81d8de9fe6a2763601da1f22a0bb2641e09b

        • C:\Program Files (x86)\AVStrike\Common Tools.dll

          Filesize

          176KB

          MD5

          9b2065ccce15d9980bac9b085f0048b1

          SHA1

          b6a980e5b336039d87f794e106074b4e6cecdd86

          SHA256

          18e0affb2d6fa5316bcfe7ffb5762ba37366d954c977e2f8b3a93d8b90169cbe

          SHA512

          ac745375d066806a8a7b13a1ae7cc15c24e916e5a9d5028f65a1454b076dca409b2c18abc15780eef65ff6e667519f743e817f7e9f5a4050f8bb42948aaf2956

        • C:\Program Files (x86)\AVStrike\Core.dll

          Filesize

          245KB

          MD5

          132bbbab05d33d8b7a7659caf902d6e0

          SHA1

          22c29159eee0e9cf33c1a04c9113ce5b743b7081

          SHA256

          fa467404e0dfd9792c4fb41d5513f7d72fbbb7e099e6106fde95c842cd24325c

          SHA512

          30b6b22a51e17f8b734d5465c64d44e8e75605d536ff2f6f47b33cac74077cf820eda17d30389d2eb93d4e091cfb9969eee531d8e0b85c06656d3ba4800ccfdc

        • C:\Program Files (x86)\AVStrike\Error-20241107.txt

          Filesize

          1KB

          MD5

          84a4b77bfca9e2ff634f57ce29140cdc

          SHA1

          5cbacdfd9f2429eec1793296676ea11fd779da2b

          SHA256

          30b4f35db8b7cd8c3b319579025fa655209f2d726d164fb6163d3e2469ac9e6e

          SHA512

          514c2edddc4d6eaec58533935433e41abfc3c862e25d6f8b092e7f88df33664ec356ae44f58da8bf254cb8aaefe5216fef41bad77b6e5dded360fd6e00ac9ff6

        • C:\Program Files (x86)\AVStrike\System.Data.SQLite.dll

          Filesize

          927KB

          MD5

          8943a2272551512a5d5a7b14bdd00642

          SHA1

          10765fa31727f8033910cde8c8f80f82967537d1

          SHA256

          b76a0c8295fe09f08aca6f5624a571741d0f7d5162935e8b403c221f51e5a29e

          SHA512

          1b454c33f195c499d913c136b9bc0afddabd85fd38186c3fa840759dcfe981802f254ea49ccad7e4b8f6363a6d7bf51608e2ade7b80ead93cc95f394ff9e605b

        • C:\Program Files (x86)\AVStrike\db\AVStrikeDB.ldb

          Filesize

          166B

          MD5

          de898899ffb1e32309a60fd601ca76df

          SHA1

          7aef58f9512458a7a250f090dab0b61a6c283282

          SHA256

          7b1142ad26a4cbf5dba0d7fac584bcee73b03ba35de53bf865809646728c24fc

          SHA512

          555d32b6b7ea03e650d92f8737b7cbbd313fe8b7102328a4765134a0675e7af52498fc8fd0adba1c88d41e1f5ce511055089299ae83537bb207ff2b5a337fb6d

        • C:\Program Files (x86)\AVStrike\db\bytecode.cld

          Filesize

          337KB

          MD5

          970952477c6285a57141506f4506a15a

          SHA1

          0bfd399f8a5b85defa569fe54f459165142ffdd9

          SHA256

          eba384089d1d33034e15f1014c4c8cfd45adf63c933b096d5d9beae3b772f568

          SHA512

          f4f3d3e9989d8647a1f0f0878fcf17fda27f3e2aad5f61f271348630eafe714f0962e36917729317e144ed0be590e78c277df9a064627209404aace6c9448fd7

        • C:\Program Files (x86)\AVStrike\db\daily.cld

          Filesize

          49.4MB

          MD5

          50fbd12738c2cb401afbbf803906dc08

          SHA1

          b0c86564fbc6812a0f123c2f39c44e77d430a0ae

          SHA256

          998b8a3f828c12f2d1b296b099180d345a4d537d8c5c5a7c9743bcda82d33ff4

          SHA512

          f52eb499f8f62240599c6aebf7a1d41455a60eb919846abe7f46f4856b604b5d5e458b2154f330255315e57ba982efef3aac83cc9e9972510346fdcbb8a9542f

        • C:\Program Files (x86)\AVStrike\libclamav.dll

          Filesize

          2.6MB

          MD5

          e5ca400a4579a0b6e943b0e165a479b2

          SHA1

          b651842e6e7b547fb9db5b34fea5b49a20718361

          SHA256

          2b54ff03ba3d151f11f27eb85c01eb2646657764d8d6b87647bf9ee2573566de

          SHA512

          c550ebc0b40710943c6a2f17626457b971d774d9e78f30b3117e221b4b9eedf1920b668c1c1ad095f7db2c7a313b587a7f746045f542024156110cfccf042a45

        • C:\Program Files (x86)\AVStrike\scandll.dll

          Filesize

          9KB

          MD5

          95e4717876a51ab4ab47603f1dd854f1

          SHA1

          02367faeb8654ddacebb8cb559b08f9f87249b74

          SHA256

          594484c04962483d9ad0acb0e2fb97c8a3f19d29f80212fdcda817bca8ff5a58

          SHA512

          52873f570d733105a2c908874d3ec1468752d51edfa5354a0f4eec62e327dd6477d1870345598aec4418ae5cc4d36609eb81948c66f4892c94e54b698dcc2484

        • C:\Users\Admin\AppData\Local\AVStrike_LLC\AVStrike.exe_Url_tje5nlxlhq2l5smqmcjvg0fo0avsv0ve\0.0.0.6\user.config

          Filesize

          341B

          MD5

          41132e9c1e48e2ad7dfe4fa1052999a9

          SHA1

          83859909d3b8550ff4e8540013d6c24ecffacac6

          SHA256

          6ec18244e8867172ed48c49fe03b92f6d162e4002669e15aae5bde475ac85f35

          SHA512

          1456e0e75361a53dfdb606eeba60fad3ae61e1183256fe688cafb18475793035246b4eb4fe2673cfdc41299a634224e94df4fc3b967e068bbefe0228331e34a9

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\AccessControl.dll

          Filesize

          8KB

          MD5

          9f1a88b953fd2a2c23b09703b253186c

          SHA1

          29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737

          SHA256

          8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d

          SHA512

          10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\UserInfo.dll

          Filesize

          4KB

          MD5

          7579ade7ae1747a31960a228ce02e666

          SHA1

          8ec8571a296737e819dcf86353a43fcf8ec63351

          SHA256

          564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

          SHA512

          a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\ioSpecial.ini

          Filesize

          684B

          MD5

          2c5e6778fbdc9dc5d05e6e20caff0a34

          SHA1

          dd3c6de1fd27a0297af4e7ac3e11936acff3b8a3

          SHA256

          8aa254d0092425741fb21c330281896bb34abcce45c7c1d7a096051f3add2f03

          SHA512

          3c68d15074fe12011f4c5c82142cc6cb736b7a1566599bc10d126748b3e20faef0fc852c6c93e43f969079f9af3865eed1e6f1da0be9f22c6c2442c204dc4bda

        • C:\Users\Admin\AppData\Local\Temp\nsb9636.tmp\ioSpecial.ini

          Filesize

          656B

          MD5

          76598dcca68e7fe2aaa149c7b2ee92ab

          SHA1

          5b0622c9f1c32e27c8b05d5487b3c1747f482b24

          SHA256

          651218fef8108e8566e9bc9f1e717bff9bbe3d11cdaca53394b5e4b94283627a

          SHA512

          3e338e04824df10bee506da07d74ee1c936262e78bc11fe73dfc04c119bb8ade73095a815637614da72ea62fc74fcda6f112524982254d2610287efe1e7f76e3

        • memory/500-313-0x0000000074DE0000-0x0000000075391000-memory.dmp

          Filesize

          5.7MB

        • memory/500-345-0x0000000074DE0000-0x0000000075391000-memory.dmp

          Filesize

          5.7MB

        • memory/500-311-0x0000000074DE1000-0x0000000074DE2000-memory.dmp

          Filesize

          4KB

        • memory/500-312-0x0000000074DE0000-0x0000000075391000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-261-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-259-0x0000000073461000-0x0000000073462000-memory.dmp

          Filesize

          4KB

        • memory/1696-309-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-260-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-270-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-268-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/1696-269-0x0000000073460000-0x0000000073A11000-memory.dmp

          Filesize

          5.7MB

        • memory/2380-258-0x00000000745A0000-0x00000000745AA000-memory.dmp

          Filesize

          40KB

        • memory/2380-138-0x00000000745A0000-0x00000000745AA000-memory.dmp

          Filesize

          40KB

        • memory/2380-121-0x00000000745A0000-0x00000000745AA000-memory.dmp

          Filesize

          40KB