febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb

General

Target

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
Size

419KB
MD5

c85b63aa4526b91acc9ad26f2b142688
SHA1

3adf5f527aa132e874b48a0309f1392f5730430d
SHA256

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb
SHA512

5d473f4fa6a7d941038c0fa9fa07888824931f388612a7cd3591ec320ecccea204ca628ee5428d352cd7d12d93996ce34c76b3ea57bb79f2ad551c8ee0f3579a
SSDEEP

12288:YDFScMV3Ws98EynVPLnDonKArpSNflx+ExlCny6e:YDkcKynVPLnDOKArpSNflxP+y6e

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
File opened (read-only)	\??\F:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\R:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\T:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\U:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\V:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\X:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Z:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\A:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\J:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\K:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\N:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Y:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\B:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\H:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\O:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\P:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Q:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\S:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\E:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\I:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\L:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\M:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\W:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\G:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

Drops file in Program Files directory 2 IoCs

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
"C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000000210000-0x0000000000214000-memory.dmp

Filesize
16KB

Download
memory/536-55-0x000000013F640000-0x000000013F69F000-memory.dmp

Filesize
380KB

Download
memory/536-56-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/536-57-0x0000000000200000-0x0000000000205000-memory.dmp

Filesize
20KB

Download
memory/536-58-0x0000000000210000-0x0000000000214000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads