Overview

overview

9

Static

static

mtasa-1.5.9.exe

windows7-x64

9

mtasa-1.5.9.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    91s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2023, 03:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mtasa-1.5.9.exe

  • Size

    99.1MB

  • MD5

    3a18551eb8a004be178629a088ba2763

  • SHA1

    586612e58bcbee1d6ee86804709fcc3cd7cc6143

  • SHA256

    1a1cf5342a69dc344d5b4e71f4822b93440377952f5bd5ca53da9c06d325624d

  • SHA512

    c4dcbd716b5267f0df3465a9ef16ba18f3b29222ce64e8d0269c2defcf572dfcc66e578083a26e47a6def9ed4b7eeacc0b8bc99ceb0c537d6ab1c396660a9ab1

  • SSDEEP

    1572864:mnsmJ+Mcx1iJzC9Q1W0AXu5bwAir+nrUhugrAGmXQw6tL6/Q11Szt0zdLxb2XBL0:msX48aQG1e+rUhFWeL6/MkztqdL1cB1u

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\mtasa-1.5.9.exe
    "C:\Users\Admin\AppData\Local\Temp\mtasa-1.5.9.exe"
    1⤵
    • Loads dropped DLL
    PID:3492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\AccessControl.dll
    Filesize

    8KB

    MD5

    65d017ba65785b43720de6c9979a2e8c

    SHA1

    0aed2846e1b338077bae5a7f756c345a5c90d8a9

    SHA256

    ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac

    SHA512

    31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\InstallOptions.dll
    Filesize

    15KB

    MD5

    89351a0a6a89519c86c5531e20dab9ea

    SHA1

    9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

    SHA256

    f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

    SHA512

    13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    a1cd3f159ef78d9ace162f067b544fd9

    SHA1

    72671fdf4bfeeb99b392685bf01081b4a0b3ae66

    SHA256

    47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

    SHA512

    ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\System.dll
    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\System.dll
    Filesize

    11KB

    MD5

    bf712f32249029466fa86756f5546950

    SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

    SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

    SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\UAC.dll
    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsr98AD.tmp\nsArray.dll
    Filesize

    6KB

    MD5

    7fc4723bb0a4118e5f91047021d1aacd

    SHA1

    092a321a21d802045105ecc8cd3c9d7d2c6da923

    SHA256

    8f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd

    SHA512

    1fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02

    Download Submit

  • memory/3492-138-0x00000000740B0000-0x00000000740BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3492-140-0x00000000740A0000-0x00000000740AB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3492-141-0x00000000740A0000-0x00000000740AB000-memory.dmp

    Filesize

    44KB

    Download