1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
Size

173KB
MD5

09974794f6fb95d8a4ade88cb04f1d51
SHA1

aa578586d1e9c5eb534c7a0567935fadb63e4340
SHA256

1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3
SHA512

c8f9db6492b047c4a5f16653c1fd89d764cbd1642b646591d984294dfe48ba2bd62c0f5db47c0588052ec8100b922f4c50e1ccea561bfa3becc9c3a1015dc35b
SSDEEP

3072:M5BuYAVrgUCPnN45zWZwAs9ThFEYSnjR1n0a3M1PQNIXyBWy23RPms6CJa:M50gUClEW0PFdu1nrOyBX231mp

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\version.dll	acprotect

Loads dropped DLL 9 IoCs

Processes:

1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe

pid	process
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
1608	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\version.dll	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe

C:\Users\Admin\AppData\Local\Temp\1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe
"C:\Users\Admin\AppData\Local\Temp\1ca255d0f7d00322efbb9a47af005a3bd11865cbe8c9e6a5af29a089c202d9a3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\NSISArray.dll

Filesize
20KB

MD5
5ae0c62802120e2fa971959795581daf

SHA1
e0c2d66ba75b41f8e22ff31c90986e572735429f

SHA256
a8c486730810c55c337c7d6863243fad25c212b4d11ceeceb420c4b2c131a605

SHA512
e09b14c1eef4c3962f18307df4abf4fbb62710dbf3cde80346069861b4db63e72b0441e0136921290725632f6c21b3916920e928f4df63b3f5c0e78b8e750101

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\inetc.dll

Filesize
27KB

MD5
bd30dd24c0084fd883949bdbdca225e2

SHA1
fddf52a9d22a6e614e202a0c55deb5752f4595eb

SHA256
e554d904b4903c74035772b4b20cb7cc508f7d27bfee79f424f29ad31d4caf59

SHA512
4d24c9160caaa8f3b0ca5ae13a8fc64d9c0fe722c274f63aa4c2d7379f8e4aa5bcdad45e49b62ad928d7bb759657e4a4915327fab0728ffd20dc838a4b6811e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\splash.gif

Filesize
64KB

MD5
51a08071564a56c2de78ce30f071a164

SHA1
5ec14e0b48739dab7800fe298a504ac650ca5e9a

SHA256
afde7eca0029476a898fdb059d4aaf7caa1f336ed5998c438d3d9b016d7358ff

SHA512
404233e1b039874074421985e24173b7098e3997b8157b8884eaa33cb43bd9ffe8e86eac87af15179dc1b70cc7139d4ffbec96ca484c2084a3d06e20637a6361

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA190.tmp\version.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
memory/1608-50-0x0000000002AC0000-0x0000000002ACC000-memory.dmp

Filesize
48KB

Download
memory/1608-47-0x0000000002AC0000-0x0000000002ACC000-memory.dmp

Filesize
48KB

Download