e5af4ba37023537d11cdb003956f2d91c5c980500175ed2e8d09e8097719083f | Triage

Sharing

General

Target

e5af4ba37023537d11cdb003956f2d91c5c980500175ed2e8d09e8097719083f
Size

92KB
Sample

221206-ybnq3aah2s
MD5

68dbd32820432599e2f8408101af043c
SHA1

52ad6a7c0df1958a0c6b3bcf1b53345ad8f7d2ee
SHA256

e5af4ba37023537d11cdb003956f2d91c5c980500175ed2e8d09e8097719083f
SHA512

a6b7e22718bc2889be395b7569875d3491f02c29fd24fcbe46173511e5eba90b40228a42a61dfa29d6378da4345498dcb9190a1ca1b171ae0dacdcb256036ce9
SSDEEP

1536:4O0TXh4GzNex5sazHbIqqn+wcsQM5mNKSufjbZ6MLOQIm/O2gdrXpkO9azFSoWhy:7MGZnRVq//W4vSnmmX539GFBWh3i

Score

8^/10

Malware Config

Targets

- Target
  
  e5af4ba37023537d11cdb003956f2d91c5c980500175ed2e8d09e8097719083f
- Size
  
  92KB
- MD5
  
  68dbd32820432599e2f8408101af043c
- SHA1
  
  52ad6a7c0df1958a0c6b3bcf1b53345ad8f7d2ee
- SHA256
  
  e5af4ba37023537d11cdb003956f2d91c5c980500175ed2e8d09e8097719083f
- SHA512
  
  a6b7e22718bc2889be395b7569875d3491f02c29fd24fcbe46173511e5eba90b40228a42a61dfa29d6378da4345498dcb9190a1ca1b171ae0dacdcb256036ce9
- SSDEEP
  
  1536:4O0TXh4GzNex5sazHbIqqn+wcsQM5mNKSufjbZ6MLOQIm/O2gdrXpkO9azFSoWhy:7MGZnRVq//W4vSnmmX539GFBWh3i
Score

8^/10
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2