6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476

General

Target

6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
Size

3.5MB
MD5

a54d0dfcc9a997510b45a7f1486ea3d5
SHA1

bac1c4cf78a6977aa17dca5588dee52dd5d98b78
SHA256

6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476
SHA512

8e4f638f3fcf82ea500915089acbcc132eca976aa919dd2a0b25c6dbd20320d28274e2c626d9ce7a8f71fa1006a5eb5eef5a20d2c72ac422a976a515a22b098b
SSDEEP

49152:9NrYtbAbbc0CGVHCcOxqoppLXCIYrKMtlBdukXK6f/8LYFlNKVZm2alZ3APS+:9rbc0dxOfbCIYflBduQn8hkgS+

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\T:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\V:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\X:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\A:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\G:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\L:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\P:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\O:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\Q:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\Z:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\F:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\I:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\M:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\N:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\B:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\H:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\Y:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\U:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\W:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\E:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\J:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\K:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
File opened (read-only)	\??\S:	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe

C:\Users\Admin\AppData\Local\Temp\6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe
"C:\Users\Admin\AppData\Local\Temp\6f6db301913cb8c72698ec59c30ef19ba7017726f0a6b7f2739d16cb28100476.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1132-55-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1132-56-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1132-57-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1132-58-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1132-59-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download
memory/1132-60-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1132-61-0x0000000000400000-0x0000000000A49000-memory.dmp

Filesize
6.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads