f671a079f5f6ba764c5aa771b4c0bdfee1941aebe005eec073cb980893912c88 | Triage

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 14:07

Sharing

Report Analysis Logs

General

Target

$TEMP/sobar.exe
Size

453KB
MD5

838cc2fcf7a581a88c37f62f668f2963
SHA1

dc5a07763b3cfd470a8961f28ddf203218f8b6e6
SHA256

ea9831bc7fe7c3d3a1f6c6cb01ed382e76322fee1d792d5a36f63a001b7a868e
SHA512

03de4513c4b2108cb041e375fd693adb0e99ce1c47cd5902a6d2d01698c9ceb0b2b27f39710eff5ad7d7ab492259874bd8dc16688350490549fb35ef85cbfc21
SSDEEP

6144:Vqn/RLQoaQOgOk0JYE9ldDbVOC8G3vfFuJAcSpXsaYI6eTb+VLyrgkXoCGdBW4Gg:S6oCgAXtDbQCh3vtuuDp8SqV2GjM8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\$TEMP\sobar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\sobar.exe"
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads