f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e

Analysis

max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
Size

74KB
MD5

1c7243c8f3586b799a5f9a2e4200aa92
SHA1

4db5a8e237937b6d7b435a8506b8584121a7e9e3
SHA256

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
SHA512

56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
SSDEEP

1536:b6sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gLi9+LSG:b6srVzJiRrTHVORe75g4+LS

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brbbot = "C:\\Users\\Admin\\AppData\\Roaming\\f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe"	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

pid	process
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
836	f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

C:\Users\Admin\AppData\Local\Temp\f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
"C:\Users\Admin\AppData\Local\Temp\f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads