Analysis
-
max time kernel
50s -
max time network
80s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
02/01/2023, 09:03
General
-
Target
mtasa_x64-1.5.9-rc-21507-20230101.exe
-
Size
3.8MB
-
MD5
9f9038679c5deb05627799bcea968cf0
-
SHA1
470cdbb42ba3480fa4ccaafb7ef6a3304ca42bca
-
SHA256
0259d599b7e74d4cb96fdf3a0f6ccd14619b041a384b80b183c923d366984174
-
SHA512
025c708ee98e37d8c4ce611b31b1bb6649aa779b96b800b070713bc50f96eafe6b73d5674fc04c89b114d07dd3f6d0648d7595ea33a854d307d9a8357c4268ee
-
SSDEEP
98304:mOjV8f+qQq5bNSwwWhZ0rkak6+AG4ITQ1OKdpDD04/KxJzY:thsxQWekaXXG4Ic1OKdpDDMJzY
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 20 IoCs
-
Drops file in Program Files directory 38 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mtasa_x64-1.5.9-rc-21507-20230101.exe"C:\Users\Admin\AppData\Local\Temp\mtasa_x64-1.5.9-rc-21507-20230101.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\MTA San Andreas 1.5\server\MTA Server64.exe"C:\Program Files (x86)\MTA San Andreas 1.5\server\MTA Server64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5d6e8e120cefd143d11f592e53522470e
SHA1575720f73876fa2205eddd8e7399889778926ed5
SHA2569aa4198df1c87dc2e3c51b182d14f8db2cd092b6391ade9b549b33883ce47c05
SHA51249fb01dd875cf24012f792f173261bbcf5a833142054604072f93f4cdd87f05341026cea556d20e8f7fadb80547c2f3295e0658c77c38c7d37cd99c02adc57b9
-
Filesize
395KB
MD5d6e8e120cefd143d11f592e53522470e
SHA1575720f73876fa2205eddd8e7399889778926ed5
SHA2569aa4198df1c87dc2e3c51b182d14f8db2cd092b6391ade9b549b33883ce47c05
SHA51249fb01dd875cf24012f792f173261bbcf5a833142054604072f93f4cdd87f05341026cea556d20e8f7fadb80547c2f3295e0658c77c38c7d37cd99c02adc57b9
-
Filesize
13KB
MD5f0a2adb933808fe73dad6c946552b05e
SHA1e509fd0d5bc47b6d35da6c06f4729c5f924bdea7
SHA256dbaa557a60d68a02df681d53ee0c905f246b587fa187d4eb838f5b8b1fec82f4
SHA51280bbc7dffa983383662010a03d547de2ee4457312a0bb8d6ec274619c409d840d58aa721c0c6b2077f6791580e225fa91f2ebab15c5d65b4a74b951d81ff3eda
-
Filesize
11B
MD5bacb7d3c9131e65617beafce9cf96dff
SHA138f4204db2c696dc18f2efe5eaafc60221873356
SHA256c3020f4baab6b8151be01ce3045ce1c6dc53187507928b501d2336bd90086c1e
SHA512be0531f9f2d27c9a44f5af5633f96793b1e2794f26079285017f01140e349f94fe8d3764b7832726c59bfa81bf2832ce9bb927369a59ae17de769c62829432f8
-
Filesize
17KB
MD585a135d4d73fc08d56fb2f1a30d4a9a6
SHA1c1736e580e6f2d373512044fcee9d22ac841956e
SHA25624301cff97121c1bfa8bc55c10d902529401dfb72bf5a15d5441463ad39ad016
SHA5121eb54558f2cd1c4dd3ff5c14aec167e6e3dea51cca0af7c8f5a180d0d9301d37c5c7e2794903d57a3c91c95757ee3770540e8bdfe3d2c26748b90baa5aeecde6
-
Filesize
13KB
MD5bd370bfcb3d948d4ed14c906f389768a
SHA1be2af7587c61ed1dc1a875dfef9ffb1672f61151
SHA2563e00d9c339e8df44be41e7b29592ae7c4e1247dc89a9ddcf84962b0b55245006
SHA51267ee39db804ee701e5e0186783a4cc72f329a7288a6b47f3142a294a8dcf3e29b9340c936140d6c9f214c34aef31527f246bdc3c9ebeeb9c49204727620ffd10
-
Filesize
314KB
MD578262dcf2f1782f2b2d416779bb7100c
SHA118778b6652c9137a88c42123f25d5ef9a31bc185
SHA25648a90c1349d0dba0134ad78d23676d064327234c2d752bf232a3636ee211af5f
SHA5124494b7fe79935911669c4a5e70442862a25a56deca0bd89fd3a455fccacabe7b348eaa840d0614e570b789467ac4b9004e356e4a5ee7e64bbba0df1c41eb45b9
-
Filesize
5.6MB
MD5186a606422e5d0fab73fb77ce4e4c04f
SHA1361ef57a0e7118c02f8cfcc185a139f4f3bd9ca6
SHA256bdbd3a9f9c08dfe05d1b3e1409c41bf8db802ec2c1d08a4139fb05c89ce36fd5
SHA5122e092ce87cb34065233d9f6eb4bc3a65a0e809745150192e08246f7ed8325009f93a178b5f8575d3fe2f03a1f920099a356b0923d07aea62c00b9a346e3dcaaa
-
Filesize
539KB
MD5893335f4bcf4ed6cff31abb1c4139706
SHA174b2025b3559db31936f0b6047e3e4e33f0d156f
SHA256c99b85b3ab4aab48087e241974368f0568eccb2b7f367b401bf425e903b19128
SHA51252036b8a5663e07e7fc9ee5ce71c9a63eca00958eb527eb6cc6d9efe6c56af5e87e7554b6b487d7d2586e448e73c8aa4dea8528db6348a8abfc9d71f4346ea1c
-
Filesize
2.0MB
MD5005baea68ed37c824424d48e7f2c81a9
SHA179e84f4f609b11da2901915fedb5aaa7d1017ef2
SHA256bb13c3a90dc4c3221bf963f481b44c54b8fd88dd59264b2be87de3121fb6b751
SHA5126be34f124504a7cbe64abb256950cdf32847bdcaf214849ba9233f8af36013223b988cbffbcc8498f2179ca875044658d51ae1d3b5c08e4783e5d3efb5c060ad
-
Filesize
375KB
MD55361f3c8826df6e9e1502c9893d0c066
SHA14176019f22f070092ba5684bdb1a4358d4f4ba7b
SHA256473f50a0c704683b876e0875e141baa057daceb8d186a9628686f8b345dac3ca
SHA512fcd20c788194e27a26730035cab28230e63e36d44fb15c5fdf861f6053cbce5738b4c1a1cf598711c7aec7173fa375520b4fb539f3312af9f02f58e63fb6755f
-
Filesize
170KB
MD52a647ae191d10f246a5a2d691817c3b4
SHA13a202df7dfe64954e365bb51327d092551d4fb2c
SHA256babf427be210da2af0f79da1103faf1badf208b42cc7cf4d09e4ea525aed3ebd
SHA512c1bc77b4e650ab3a5ffaf66108349ae6f42c6055c63a4b46c0f7e966bf0cbeab93088bab669ec0be2b7f90fec8a020fbbfb7a3e2e5049367484356ef5f9d9219
-
Filesize
401KB
MD52eb1b619097809456c1969e88ea57d70
SHA1aeac69872199d70c1159df6739149157b863de4d
SHA256ce34a37aeb374eed3bfe66e2549aef39b11cd5502128483fe52371f79631149c
SHA512412835bc75746a39f39dec0bb1ceddbc5febf4655d2e8f3bd8beb98c0c0ef45e346b11f1227f2ed0da18307785beddde482ad1cfc240fd766654be669b150781
-
Filesize
314KB
MD578262dcf2f1782f2b2d416779bb7100c
SHA118778b6652c9137a88c42123f25d5ef9a31bc185
SHA25648a90c1349d0dba0134ad78d23676d064327234c2d752bf232a3636ee211af5f
SHA5124494b7fe79935911669c4a5e70442862a25a56deca0bd89fd3a455fccacabe7b348eaa840d0614e570b789467ac4b9004e356e4a5ee7e64bbba0df1c41eb45b9
-
Filesize
5.6MB
MD5186a606422e5d0fab73fb77ce4e4c04f
SHA1361ef57a0e7118c02f8cfcc185a139f4f3bd9ca6
SHA256bdbd3a9f9c08dfe05d1b3e1409c41bf8db802ec2c1d08a4139fb05c89ce36fd5
SHA5122e092ce87cb34065233d9f6eb4bc3a65a0e809745150192e08246f7ed8325009f93a178b5f8575d3fe2f03a1f920099a356b0923d07aea62c00b9a346e3dcaaa
-
Filesize
539KB
MD5893335f4bcf4ed6cff31abb1c4139706
SHA174b2025b3559db31936f0b6047e3e4e33f0d156f
SHA256c99b85b3ab4aab48087e241974368f0568eccb2b7f367b401bf425e903b19128
SHA51252036b8a5663e07e7fc9ee5ce71c9a63eca00958eb527eb6cc6d9efe6c56af5e87e7554b6b487d7d2586e448e73c8aa4dea8528db6348a8abfc9d71f4346ea1c
-
Filesize
2.0MB
MD5005baea68ed37c824424d48e7f2c81a9
SHA179e84f4f609b11da2901915fedb5aaa7d1017ef2
SHA256bb13c3a90dc4c3221bf963f481b44c54b8fd88dd59264b2be87de3121fb6b751
SHA5126be34f124504a7cbe64abb256950cdf32847bdcaf214849ba9233f8af36013223b988cbffbcc8498f2179ca875044658d51ae1d3b5c08e4783e5d3efb5c060ad
-
Filesize
375KB
MD55361f3c8826df6e9e1502c9893d0c066
SHA14176019f22f070092ba5684bdb1a4358d4f4ba7b
SHA256473f50a0c704683b876e0875e141baa057daceb8d186a9628686f8b345dac3ca
SHA512fcd20c788194e27a26730035cab28230e63e36d44fb15c5fdf861f6053cbce5738b4c1a1cf598711c7aec7173fa375520b4fb539f3312af9f02f58e63fb6755f
-
Filesize
170KB
MD52a647ae191d10f246a5a2d691817c3b4
SHA13a202df7dfe64954e365bb51327d092551d4fb2c
SHA256babf427be210da2af0f79da1103faf1badf208b42cc7cf4d09e4ea525aed3ebd
SHA512c1bc77b4e650ab3a5ffaf66108349ae6f42c6055c63a4b46c0f7e966bf0cbeab93088bab669ec0be2b7f90fec8a020fbbfb7a3e2e5049367484356ef5f9d9219
-
Filesize
401KB
MD52eb1b619097809456c1969e88ea57d70
SHA1aeac69872199d70c1159df6739149157b863de4d
SHA256ce34a37aeb374eed3bfe66e2549aef39b11cd5502128483fe52371f79631149c
SHA512412835bc75746a39f39dec0bb1ceddbc5febf4655d2e8f3bd8beb98c0c0ef45e346b11f1227f2ed0da18307785beddde482ad1cfc240fd766654be669b150781
-
Filesize
8KB
MD565d017ba65785b43720de6c9979a2e8c
SHA10aed2846e1b338077bae5a7f756c345a5c90d8a9
SHA256ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac
SHA51231a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95
-
Filesize
330KB
MD57abaae90eac587c1297c539cad60f1fa
SHA1b4798d48c8e88086ac5e4a216827560d57f58f34
SHA256996160811e694a054d701372f37e76c388d7e17e2e5b2a34e527f5898c2a3aa6
SHA5125b24be666239421834037b9804029bb5c1513c433bfa6a89f7b3b7890a2a07cc5f86e01e99d23199763b12c9404fdbe70e760df77a35db19ab6c3d4600f07219
-
Filesize
330KB
MD57abaae90eac587c1297c539cad60f1fa
SHA1b4798d48c8e88086ac5e4a216827560d57f58f34
SHA256996160811e694a054d701372f37e76c388d7e17e2e5b2a34e527f5898c2a3aa6
SHA5125b24be666239421834037b9804029bb5c1513c433bfa6a89f7b3b7890a2a07cc5f86e01e99d23199763b12c9404fdbe70e760df77a35db19ab6c3d4600f07219
-
Filesize
15KB
MD589351a0a6a89519c86c5531e20dab9ea
SHA19e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
SHA256f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
SHA51213168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
-
Filesize
5KB
MD5a1cd3f159ef78d9ace162f067b544fd9
SHA172671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA25647b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
SHA512ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
Filesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
-
Filesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
-
Filesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
-
Filesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
-
Filesize
6KB
MD57fc4723bb0a4118e5f91047021d1aacd
SHA1092a321a21d802045105ecc8cd3c9d7d2c6da923
SHA2568f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd
SHA5121fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
44KB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
344KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB