7d6be4b3daa2368440ac353b8109a07d8da87b5742f78b5dd03429aa3f9a148d

Analysis

max time kernel
200s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
Size

78.5MB
MD5

514e1bb79fab232075240452c98cc096
SHA1

75784132ce7516e01fd68fc54f522a6ebdf0a14b
SHA256

80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f
SHA512

3c27fad4c68a347407dcb7c42d794652d7567403a9e8e0cc39bae6ce89888d9981a5b1f6677812c1bf87973c3d6979b3ac9cb6df791e416461520bd9c8d09caa
SSDEEP

1572864:9iazngZ45kuuk0DeEXOxnUxUwNzVofkGXEZIcRUU+7M:0akI2eEXGU6wNzDtI5t7M

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0003000000004ed5-28.dat	acprotect
behavioral1/files/0x0006000000018b15-34.dat	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000004ed5-28.dat	upx
behavioral1/memory/3020-30-0x0000000074830000-0x000000007483A000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-34.dat	upx
behavioral1/memory/3020-36-0x00000000743B0000-0x00000000743BB000-memory.dmp	upx
behavioral1/memory/3020-39-0x0000000074830000-0x000000007483A000-memory.dmp	upx
behavioral1/memory/3020-123-0x00000000743B0000-0x00000000743BB000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
3020	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
"C:\Users\Admin\AppData\Local\Temp\80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe"
1⤵
- Loads dropped DLL
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst584F.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst584F.tmp\ioSpecial.ini

Filesize
1KB

MD5
bb531281afa58e151ff3087dfa7d6125

SHA1
3cbab23343a21fffa9e81b1fa573713b5b5b202f

SHA256
13415695ce521b103bc7368ee66014f6a1c59a8716ae8aa0c87ebb18d7e65fd6

SHA512
4cf1f4fa4d57b99316f006aa534937f9d6a1029942814c4b6bfbb887724664f331f539ef6090a2d42321cfc36b9669e93e11e433913eccae7bf2963d8e4b576d

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\AccessControl.dll

Filesize
8KB

MD5
65d017ba65785b43720de6c9979a2e8c

SHA1
0aed2846e1b338077bae5a7f756c345a5c90d8a9

SHA256
ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac

SHA512
31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nst584F.tmp\nsArray.dll

Filesize
6KB

MD5
7fc4723bb0a4118e5f91047021d1aacd

SHA1
092a321a21d802045105ecc8cd3c9d7d2c6da923

SHA256
8f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd

SHA512
1fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02

Download Submit
memory/3020-30-0x0000000074830000-0x000000007483A000-memory.dmp

Filesize
40KB

Download
memory/3020-39-0x0000000074830000-0x000000007483A000-memory.dmp

Filesize
40KB

Download
memory/3020-36-0x00000000743B0000-0x00000000743BB000-memory.dmp

Filesize
44KB

Download
memory/3020-123-0x00000000743B0000-0x00000000743BB000-memory.dmp

Filesize
44KB

Download