Analysis
-
max time kernel
300s -
max time network
322s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 17:10
Static task
static1
Behavioral task
behavioral1
Sample
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Resource
win10v2004-20221111-en
General
-
Target
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
-
Size
321KB
-
MD5
202abd23dec75fab22e4491370766ace
-
SHA1
7542d762d10bfce7a4db51c90ae0ef92169f84c3
-
SHA256
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973
-
SHA512
c6505fa288b567f89b8b4a5417b97fbed6a6d6916ca77259609bd3f88d0df69df98ffbf1109fb3379519d2aae29fd2cf8f2adeb485d465fffdd4eb9b08f504d0
-
SSDEEP
6144:G8Y1R/p82CzYrNZMTqGDX7ye5/11Wc1U9kgPuIfeTnDCQMU+b:Xex3ZMbWeN11ZUCgPVfy+QMUm
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe -
Drops file in Windows directory 1 IoCs
Processes:
2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exedescription ioc process File created C:\Windows\Tasks\BeerBrother.job 2549ea70d15e6a10fa6811c32e98c0e64ae689dcf04232dd7283a110eaa88973.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4500-132-0x00000000017E0000-0x00000000018E0000-memory.dmpFilesize
1024KB
-
memory/4500-133-0x00000000017E0000-0x00000000018E0000-memory.dmpFilesize
1024KB
-
memory/4500-134-0x0000000000F40000-0x0000000000F6F000-memory.dmpFilesize
188KB
-
memory/4500-138-0x00000000050D0000-0x00000000050F7000-memory.dmpFilesize
156KB