General
-
Target
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe
-
Size
1.9MB
-
Sample
240104-y1lb8saean
-
MD5
48cca537bfc1077877a1227b5d074868
-
SHA1
6dfab03c599aabc5aff8b3c4e2836cc123b149e4
-
SHA256
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69
-
SHA512
544da6e33c5e0402d754b6bd751f290d0d8106ffbde262eda4c55aed4bef3baf58cac3bd722c0df63d57c4b27f7aa8a8110de942c8dc4246ce730ceda1b26884
-
SSDEEP
49152:WU5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:NE03yNFRbEMR5cea
Static task
static1
Behavioral task
behavioral1
Sample
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe
-
Size
1.9MB
-
MD5
48cca537bfc1077877a1227b5d074868
-
SHA1
6dfab03c599aabc5aff8b3c4e2836cc123b149e4
-
SHA256
49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69
-
SHA512
544da6e33c5e0402d754b6bd751f290d0d8106ffbde262eda4c55aed4bef3baf58cac3bd722c0df63d57c4b27f7aa8a8110de942c8dc4246ce730ceda1b26884
-
SSDEEP
49152:WU5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:NE03yNFRbEMR5cea
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1