bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830

General

Target

bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
Size

819KB
MD5

0843e1bebcb87dc740e2a1c0fec6080a
SHA1

84a4f788a8e79a5bf24a1d96648abc3c76c0f3fa
SHA256

bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830
SHA512

b5a9e5eafbfce5998e7e33aef46664cf3168d3a207c5cfe72c6bbf377f10afad610a19b0c060f08d6261be03fa695b39d8347fee9899fcce84674fd691c31982
SSDEEP

6144:iv27jyGy1/pEli1TQXG3QsE0VdQTQRwvwjvaIy7snJ96e8NBRs:6/Fpl1UXGRVpw4jyIygnJ90TS

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1148-54-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1148-55-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\L:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\N:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\X:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\V:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\W:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\G:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\M:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\P:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\T:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\U:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\R:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\S:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\Y:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\E:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\H:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\I:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\K:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\O:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\B:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\F:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\J:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\Q:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened (read-only)	\??\Z:	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File created	C:\autorun.inf	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NetInfo.exe	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
File opened for modification	C:\Windows\SysWOW64\NetInfo.exe	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1148	bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe

C:\Users\Admin\AppData\Local\Temp\bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe
"C:\Users\Admin\AppData\Local\Temp\bef8c1e15c19563df8da3af8fdc6602fabbc4f9390d4a91c367bac7556c3a830.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-54-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1148-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads