f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/DownloadACC.exe
Size

173KB
MD5

5b8ce50b86087b55003e5caeffcc32fb
SHA1

e344aacaa4f4d00e1ed019ddfa9a7f7996af6065
SHA256

14ef81c0125d8d2c4580194544ee9313e9100f47317a82b04efe2c26c1cd690e
SHA512

daa066ff3fb9add817b4bc17a9b72ee7ecc0b1869ab4b8f7d70895ec39ba1f63976a06ceaee2c2bc1c4b117d80b8456a92263e75e86b4d67cfb1a6ac25b12c21
SSDEEP

3072:DPC23aJFC0bPnjP4TXqzCiNtFoYLMcbqAe3IQlAGjn/h6GOpJkPJ:iC0bET6zvHzMUUBAG7h6GOvEJ

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral6/files/0x0007000000023438-10.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2568	DownloadACC.exe
2568	DownloadACC.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral6/memory/2568-11-0x0000000074950000-0x000000007498E000-memory.dmp	upx
behavioral6/files/0x0007000000023438-10.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DownloadACC.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DownloadACC.exe"
1⤵
- Loads dropped DLL
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq497D.tmp\DownloadACC.dll

Filesize
97KB

MD5
807114f67a584a8e4ba9117cf60d3c88

SHA1
7187ed05aeade46ce4023a50b6e4b6ece2f3e69d

SHA256
8068ea7fd96dee94bbb22e9282880b33fd08b31e96a580e6bd8c29c51ce8550f

SHA512
69c38913503729d9117f6618c754673f204b8b3e4f9d82ddc271f34b48f2d3fa26931aee366b3b5d71cbc7364b97769c4d502cbd21faa756f3d93940be730b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq497D.tmp\System.dll

Filesize
17KB

MD5
7faa4cede342ffaa00ee96491866baec

SHA1
f686373e0f4026600640895e91b11a4277269972

SHA256
28c00e1cb4147a0001a5e05daeac9bd738f63e106ba25d6bc5987c4ff1df97d7

SHA512
77c43c8cc4f32cbcd73bdd9d6cbcc4bbccedff7f62f461273ebe49a1f2c5a63d29e16e3c16c3a6d3949ec95dfcbd79be0fb98f3354281b02c6ef74e8eed69894

Download Submit
memory/2568-11-0x0000000074950000-0x000000007498E000-memory.dmp

Filesize
248KB

Download