Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 17:10
Static task
static1
Behavioral task
behavioral1
Sample
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Resource
win10v2004-20221111-en
General
-
Target
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
-
Size
321KB
-
MD5
202abd23dec75fab22e4491370766ace
-
SHA1
7542d762d10bfce7a4db51c90ae0ef92169f84c3
-
SHA256
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973
-
SHA512
c6505fa288b567f89b8b4a5417b97fbed6a6d6916ca77259609bd3f88d0df69df98ffbf1109fb3379519d2aae29fd2cf8f2adeb485d465fffdd4eb9b08f504d0
-
SSDEEP
6144:G8Y1R/p82CzYrNZMTqGDX7ye5/11Wc1U9kgPuIfeTnDCQMU+b:Xex3ZMbWeN11ZUCgPVfy+QMUm
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe -
Drops file in Windows directory 1 IoCs
Processes:
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exedescription ioc process File created C:\Windows\Tasks\BeerBrother.job 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1496-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1496-55-0x0000000000EE0000-0x0000000000F0F000-memory.dmpFilesize
188KB
-
memory/1496-59-0x0000000000F50000-0x0000000000F77000-memory.dmpFilesize
156KB
-
memory/1496-63-0x0000000001191000-0x00000000011BB000-memory.dmpFilesize
168KB
-
memory/1496-64-0x0000000001191000-0x00000000011BB000-memory.dmpFilesize
168KB