4af8536f98e03dfc5f5be911ff79ef6c0cbc8b942c855b0dcac530b3058f34b5

Analysis

Target

bCZe.exe
Size

14KB
MD5

352e1de7d7a5ab9896dd809e57e231b7
SHA1

ced36a4fb72fade359d0dea6585bc5f1d6dad9d5
SHA256

4af8536f98e03dfc5f5be911ff79ef6c0cbc8b942c855b0dcac530b3058f34b5
SHA512

8774fabb9917ac6ee00ff3136d061aed3918b078d03d43594fcfa8063af9bcb08c5b1464bc4e81aa50145b48483105c564e13ae7045a3153bd86482ab9d460b0

Score

10^/10

suricata

suricata: ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2
suricata: ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2
suricata

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

bCZe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	bCZe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bCZe.exe

C:\Users\Admin\AppData\Local\Temp\bCZe.exe
"C:\Users\Admin\AppData\Local\Temp\bCZe.exe"
1⤵
- Checks processor information in registry
PID:1808

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1808-130-0x0000000074F30000-0x00000000754E1000-memory.dmp

Filesize
5.7MB

Download
memory/1808-131-0x0000000074F30000-0x00000000754E1000-memory.dmp

Filesize
5.7MB

Download