bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2

General

Target

bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
Size

4.8MB
MD5

4b445a02b8872a2574993c5e173308c7
SHA1

57f6a67bb867875385c9958bcdb5fbd65ceed128
SHA256

bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2
SHA512

caf9b9ccccec9834bd5208449713c49cfd52ba9df6dc2d75033358c5aa0653a7f98676b42e90c247cd2406132676c4ec9a7c0c55bf06951a28dba8818d78356d
SSDEEP

98304:AoHNZepsSVs2Z/oexNikDBqb+9y6z593NWvQW52ivHjOLM5yol+rQ1m6XVvU:AotZgs21BRLdoQlSOLM8gYQ1BU

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\Z:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\I:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\L:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\S:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\V:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\W:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\E:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\N:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\O:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\Q:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\R:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\U:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\Y:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\G:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\H:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\J:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\K:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\M:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\T:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
File opened (read-only)	\??\X:	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe

C:\Users\Admin\AppData\Local\Temp\bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe
"C:\Users\Admin\AppData\Local\Temp\bdc73286b2de429044ade2ef1e74bbf768e893ac1d066f34729b6780eef7f8a2.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/2976-1-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download
memory/2976-2-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/2976-4-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/2976-5-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2976-6-0x0000000002990000-0x0000000002A47000-memory.dmp

Filesize
732KB

Download
memory/2976-7-0x0000000000400000-0x0000000000CC3000-memory.dmp

Filesize
8.8MB

Download
memory/2976-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2976-10-0x0000000002990000-0x0000000002A47000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads