Resubmissions
11-12-2024 20:16
241211-y2jj2a1pbn 1007-12-2024 23:58
241207-31ftzawpbl 1006-12-2024 00:18
241206-al2hxazlh1 1005-12-2024 20:14
241205-yz2b3awpfq 1005-12-2024 18:42
241205-xcrnnswqgs 1005-12-2024 02:56
241205-dfenqs1mbl 1005-12-2024 02:56
241205-de5tja1maj 1005-12-2024 00:22
241205-an7gyavkal 1004-12-2024 22:51
241204-2s976s1mhj 10General
-
Target
accgen.exe
-
Size
7.5MB
-
Sample
241211-y2jj2a1pbn
-
MD5
f1c9d53dc67cafd6d193be9a4b33f627
-
SHA1
dc1de348ba0cd40c6b10cb528e7aee83072c6aa0
-
SHA256
45715d3b3c58ea90088529b234c4ebb34a005c5d7406b4a92a3e116aa28c26c2
-
SHA512
aaba4de3b7e9bd1e8c41e655cbe29addcbe98f62f4b6ad599fe7a59e4616881ca97a91ae0a457df0421d586eb586a13f62aff10907a386f1cf3a25be7fa6244c
-
SSDEEP
196608:WlQCwVhurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1J:LVhurEUWjqeWx06rYYJ
Behavioral task
behavioral1
Sample
accgen.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Targets
-
-
Target
accgen.exe
-
Size
7.5MB
-
MD5
f1c9d53dc67cafd6d193be9a4b33f627
-
SHA1
dc1de348ba0cd40c6b10cb528e7aee83072c6aa0
-
SHA256
45715d3b3c58ea90088529b234c4ebb34a005c5d7406b4a92a3e116aa28c26c2
-
SHA512
aaba4de3b7e9bd1e8c41e655cbe29addcbe98f62f4b6ad599fe7a59e4616881ca97a91ae0a457df0421d586eb586a13f62aff10907a386f1cf3a25be7fa6244c
-
SSDEEP
196608:WlQCwVhurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1J:LVhurEUWjqeWx06rYYJ
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3