Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2023 16:58

General

  • Target

    MrBeast.exe

  • Size

    3.6MB

  • MD5

    1dadda882b9fb38f4f6568968d90ebff

  • SHA1

    6ff605d69494c75bb5d34a364956bbe5eb63defc

  • SHA256

    ea041dabf8f9790ce767ad47e383507db97d26fc27e5fd6a578f6232587aa91f

  • SHA512

    461c864cfa40f56d37ffc8a11e518698d10c654b18d543f36d4fde80b317b1b809d3ad9cf5ff99334c8210ca98ed07ad2278228c7f242241d157eac8a9a7c9c3

  • SSDEEP

    98304:Rwowao+WTd1a/mP4NYGcjzwowao+WTd1a/mP4NY:RHwQ0XZJGcvHwQ0XZJ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MrBeast.exe
    "C:\Users\Admin\AppData\Local\Temp\MrBeast.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    PID:2076

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2076-132-0x0000000000320000-0x00000000006C2000-memory.dmp

    Filesize

    3.6MB

  • memory/2076-133-0x0000000005040000-0x00000000050DC000-memory.dmp

    Filesize

    624KB

  • memory/2076-134-0x00000000056C0000-0x0000000005C64000-memory.dmp

    Filesize

    5.6MB

  • memory/2076-135-0x00000000051B0000-0x0000000005242000-memory.dmp

    Filesize

    584KB

  • memory/2076-136-0x0000000005110000-0x000000000511A000-memory.dmp

    Filesize

    40KB

  • memory/2076-137-0x0000000005340000-0x0000000005396000-memory.dmp

    Filesize

    344KB

  • memory/2076-138-0x0000000005150000-0x0000000005164000-memory.dmp

    Filesize

    80KB

  • memory/2076-139-0x0000000005DD0000-0x0000000005E28000-memory.dmp

    Filesize

    352KB