eb097699eae6adc26cc4411094fa5b78d951c8a80079b88057d0ce0d178f9c4b

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e5b82270390220b10b0f4be763c2c1.exe
Size

59KB
MD5

17e5b82270390220b10b0f4be763c2c1
SHA1

347fe3f2a43a12f579dad6ac3c0990fce747b47d
SHA256

eb097699eae6adc26cc4411094fa5b78d951c8a80079b88057d0ce0d178f9c4b
SHA512

9e57f66b3adb8d3c64929fbfda0db282254e509cb9d9bf1fa0b45ddba9f0202d095c14c4325d48aa7531970e2bff2b1fe74669a2ae059c36bfebf17c746729fb
SSDEEP

1536:xf4exGDkeZ4mOoSgJEAJJZGiA4yL6j22HpkV71sG:p4eYZ4+1JXJJkBwTpU71sG

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023219-6.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
4740	17e5b82270390220b10b0f4be763c2c1.exe
4740	17e5b82270390220b10b0f4be763c2c1.exe
4740	17e5b82270390220b10b0f4be763c2c1.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023219-6.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\17e5b82270390220b10b0f4be763c2c1.exe
"C:\Users\Admin\AppData\Local\Temp\17e5b82270390220b10b0f4be763c2c1.exe"
1⤵
- Loads dropped DLL
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsp9164.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp9164.tmp\nsRandom.dll

Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
memory/4740-13-0x00000000022E0000-0x00000000022F2000-memory.dmp

Filesize
72KB

Download
memory/4740-12-0x00000000022E0000-0x00000000022F2000-memory.dmp

Filesize
72KB

Download
memory/4740-16-0x00000000022E0000-0x00000000022F2000-memory.dmp

Filesize
72KB

Download
memory/4740-17-0x00000000022E0000-0x00000000022F2000-memory.dmp

Filesize
72KB

Download