Overview

overview

8

Static

static

3

advbattoex...er.exe

windows11-21h2-x64

8

Resubmissions

15-04-2024 19:50

240415-ykmkcsef56 10

15-04-2024 19:28

240415-x6p2yaeb62 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    advbattoexeconverter.exe

  • Size

    804KB

  • Sample

    240415-x6p2yaeb62

  • MD5

    83bb1b476c7143552853a2cf983c1142

  • SHA1

    8ff8ed5c533d70a7d933ec45264dd700145acd8c

  • SHA256

    af09248cb756488850f9e6f9a7a00149005bf47a9b2087b792ff6bd937297ffb

  • SHA512

    6916c6c5addf43f56b9de217e1b640ab6f4d7e5a73cd33a7189f66c9b7f0b954c5aa635f92fcef5692ca0ca0c8767e97a678e90d545079b5e6d421555f5b761a

  • SSDEEP

    24576:0xFkFHdJ8aT/iziXH6FGnYhqQuimKC6Qpor:0IdJ1KiBYhsl+r

Score
8/10
persistence

Malware Config

Targets

    • Target

      advbattoexeconverter.exe

    • Size

      804KB

    • MD5

      83bb1b476c7143552853a2cf983c1142

    • SHA1

      8ff8ed5c533d70a7d933ec45264dd700145acd8c

    • SHA256

      af09248cb756488850f9e6f9a7a00149005bf47a9b2087b792ff6bd937297ffb

    • SHA512

      6916c6c5addf43f56b9de217e1b640ab6f4d7e5a73cd33a7189f66c9b7f0b954c5aa635f92fcef5692ca0ca0c8767e97a678e90d545079b5e6d421555f5b761a

    • SSDEEP

      24576:0xFkFHdJ8aT/iziXH6FGnYhqQuimKC6Qpor:0IdJ1KiBYhsl+r

    Score
    8/10
    persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks