7d6be4b3daa2368440ac353b8109a07d8da87b5742f78b5dd03429aa3f9a148d

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
Size

78.5MB
MD5

514e1bb79fab232075240452c98cc096
SHA1

75784132ce7516e01fd68fc54f522a6ebdf0a14b
SHA256

80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f
SHA512

3c27fad4c68a347407dcb7c42d794652d7567403a9e8e0cc39bae6ce89888d9981a5b1f6677812c1bf87973c3d6979b3ac9cb6df791e416461520bd9c8d09caa
SSDEEP

1572864:9iazngZ45kuuk0DeEXOxnUxUwNzVofkGXEZIcRUU+7M:0akI2eEXGU6wNzDtI5t7M

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00060000000231fa-27.dat	acprotect
behavioral2/files/0x0006000000023204-32.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231fa-27.dat	upx
behavioral2/files/0x0006000000023204-32.dat	upx
behavioral2/memory/4508-37-0x0000000074970000-0x000000007497A000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
4508	80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe
"C:\Users\Admin\AppData\Local\Temp\80e814609160b09729b8b8f4f7398f25376c350ebcd932da1b6515a208667f0f.exe"
1⤵
- Loads dropped DLL
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MTA San Andreas All\Common\Installer\nsis.log

Filesize
403B

MD5
609dc18ae9e733f34fa7146129fcde60

SHA1
fcf7ea68d4bb0c9815db3c57dd869d9e2bc231b6

SHA256
312fea6d47657770bc074f553fcddf13c9a12868221303c5309f668f264101c8

SHA512
d4c842392007b4ddffda3cc657067334f7870b9fcb7cdd816795859cc3b0635d990341dda37c95353c03ef22fc7852cdc0f6a883b13a64983050ab0bee5c9a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\AccessControl.dll

Filesize
8KB

MD5
65d017ba65785b43720de6c9979a2e8c

SHA1
0aed2846e1b338077bae5a7f756c345a5c90d8a9

SHA256
ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac

SHA512
31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\ioSpecial.ini

Filesize
1KB

MD5
7ff44eacc3f7c7acd31cc82bb7a84821

SHA1
d95b0cd2efddc1a9a5490872c4593d7654aec83e

SHA256
9509e5fef3ed1b47b601def78ec1553b8c36d4586f735e2e88d95ab49834981e

SHA512
4b89087a34c65f09b09bdf6c2077be97eb0849d6f8044a9f5f473aaca15ba70a06c855b6e571e8de543efac0a5751834d59cd5bcd16ffb741852a59845a9e16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\ioSpecial.ini

Filesize
1KB

MD5
474ea09733ce5e4d33189973c4a39d63

SHA1
c152222d1ae80f499661429a24ea96bc85cbca8a

SHA256
9f6c67f39aa7d741a4b63124b27bd3a96dcd14e266ac3ac8ff12d301ed45d2e8

SHA512
d165d8b3d08675b92d53b893918822333721a3c65d04ccd400572ff41946cf87829bc437c947e92f0b9c9619eba179ee1490f56376846f0b31231cc1f8d9d9a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8DDA.tmp\nsArray.dll

Filesize
6KB

MD5
7fc4723bb0a4118e5f91047021d1aacd

SHA1
092a321a21d802045105ecc8cd3c9d7d2c6da923

SHA256
8f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd

SHA512
1fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02

Download Submit
memory/4508-38-0x0000000074960000-0x000000007496B000-memory.dmp

Filesize
44KB

Download
memory/4508-37-0x0000000074970000-0x000000007497A000-memory.dmp

Filesize
40KB

Download
memory/4508-122-0x0000000074960000-0x000000007496B000-memory.dmp

Filesize
44KB

Download