427804c962d63a68e833840acfc268ad58583b2182caecb02ec5d0f53fcb891f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15418acbdac891bae2c86af128d9ba53
Size

282KB
Sample

231230-l26ncadfar
MD5

15418acbdac891bae2c86af128d9ba53
SHA1

dd0334f9f70dd037ca89e4ff399704d6d5cd7cb7
SHA256

427804c962d63a68e833840acfc268ad58583b2182caecb02ec5d0f53fcb891f
SHA512

68d8e2245a1e4df4f5aa1ce91af8ae3a940af8d017df723f0bde82d68eff670b8047ecca4a99281cb11a06136e3529660567e7a3d58dee3c2c0f5659877bad1c
SSDEEP

3072:X3ygYXkj7q0vTYDryO1nroU6ij4qpXqnnDibAJBVkF9nY5AW3DJLgsjoY:X5ifoTqp4nwEOY5AW3DJLgsj

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  15418acbdac891bae2c86af128d9ba53
- Size
  
  282KB
- MD5
  
  15418acbdac891bae2c86af128d9ba53
- SHA1
  
  dd0334f9f70dd037ca89e4ff399704d6d5cd7cb7
- SHA256
  
  427804c962d63a68e833840acfc268ad58583b2182caecb02ec5d0f53fcb891f
- SHA512
  
  68d8e2245a1e4df4f5aa1ce91af8ae3a940af8d017df723f0bde82d68eff670b8047ecca4a99281cb11a06136e3529660567e7a3d58dee3c2c0f5659877bad1c
- SSDEEP
  
  3072:X3ygYXkj7q0vTYDryO1nroU6ij4qpXqnnDibAJBVkF9nY5AW3DJLgsjoY:X5ifoTqp4nwEOY5AW3DJLgsj
Score

7^/10

persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2