Resubmissions

11-12-2024 20:16

241211-y2jj2a1pbn 10

07-12-2024 23:58

241207-31ftzawpbl 10

06-12-2024 00:18

241206-al2hxazlh1 10

05-12-2024 20:14

241205-yz2b3awpfq 10

05-12-2024 18:42

241205-xcrnnswqgs 10

05-12-2024 02:56

241205-dfenqs1mbl 10

05-12-2024 02:56

241205-de5tja1maj 10

05-12-2024 00:22

241205-an7gyavkal 10

04-12-2024 22:51

241204-2s976s1mhj 10

Analysis

  • max time kernel
    844s
  • max time network
    845s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 22:51

General

  • Target

    accgen.exe

  • Size

    7.5MB

  • MD5

    f1c9d53dc67cafd6d193be9a4b33f627

  • SHA1

    dc1de348ba0cd40c6b10cb528e7aee83072c6aa0

  • SHA256

    45715d3b3c58ea90088529b234c4ebb34a005c5d7406b4a92a3e116aa28c26c2

  • SHA512

    aaba4de3b7e9bd1e8c41e655cbe29addcbe98f62f4b6ad599fe7a59e4616881ca97a91ae0a457df0421d586eb586a13f62aff10907a386f1cf3a25be7fa6244c

  • SSDEEP

    196608:WlQCwVhurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1J:LVhurEUWjqeWx06rYYJ

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\accgen.exe
    "C:\Users\Admin\AppData\Local\Temp\accgen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\accgen.exe
      "C:\Users\Admin\AppData\Local\Temp\accgen.exe"
      2⤵
      • Loads dropped DLL
      PID:2104
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2816

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI20722\python312.dll

      Filesize

      1.7MB

      MD5

      18677d48ba556e529b73d6e60afaf812

      SHA1

      68f93ed1e3425432ac639a8f0911c144f1d4c986

      SHA256

      8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

      SHA512

      a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

    • memory/2104-23-0x000007FEF5700000-0x000007FEF5DC4000-memory.dmp

      Filesize

      6.8MB