d7ae7a7024e140fe4b509d61643ddfd5906b739be332e32c9153b7c79cec3213

Analysis

max time kernel
129s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SBot_AC.exe
Size

3.1MB
MD5

ea7a2cc7101dbf73fd2c0e7d2efb7e76
SHA1

fe14ac5d415e858236c84f2599d2707e9ddb579e
SHA256

a1af77c9160f9c91e8c6ae63b8efbc11989128301eefc094cabe5ff875ab3ba2
SHA512

a9d63ecc92a7c49092243be8e8f8bab77463b518991e24db491258afff5c8b96fb22963fa1e071bad301c7aa9e573ce3f02e5fc123df3e876ef6848dafe7c81b
SSDEEP

49152:B1vqjd/QMtiWQMmSFwRtApixjcv6kYjU+WtPRKFnARjXUqvMT24uO6G7gka1S4Nn:B1vqjeM4wWChtPRIA5jvER6n3NOmF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3088	SBot_AC.exe

C:\Users\Admin\AppData\Local\Temp\SBot_AC.exe
"C:\Users\Admin\AppData\Local\Temp\SBot_AC.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut3D68.tmp

Filesize
1.3MB

MD5
b006b4cb95fe4e887a801b1868d8402b

SHA1
6b7ec7d39388cd9a71c26b5674d65889831d4ced

SHA256
3317768d2eeea663d3b5301f1d5e2d92c2ed78632a120f9ad14696679631b1a3

SHA512
7efdab2a7dd6afcd0a2ebcbd07a17773e960abd504a59116de922b9cbeb0d90a28bd8fe64f57727b7589d73137aa8b0dec785c3026fbd34f07f0691bbebd5b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\error-soft\SBot AC\Images\Buttons\button_saOK.bmp

Filesize
3KB

MD5
3b8098803286a4691839b89025a63f09

SHA1
16bb59aeeff9ed275e2b07ae010c2d78ae580bdf

SHA256
aa9bc1ca7c242604d2873f6e12718ae79daca0e35628a6e26db3634c62dcf76b

SHA512
2d30cdb1e0c747f91d0423ff428056bfe0e0deea5d8f5cb48cb08ddb2b21888dd4839eab328c6e67621c9b5af1b579ae78bb7c45f62c70a47feab4882fc5e6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\error-soft\SBot AC\Images\JGlv1.PNG

Filesize
75KB

MD5
5fe5a47369ec34a637c2598960556d8d

SHA1
d8d9f766e8976c4e1144869235f4e8807a4b172c

SHA256
e5fecdc229fbea0861f2bfee515bf0e54edb2f8255ecccb2ede103c82c93e70c

SHA512
95bf3cb5e2276ff3baca44377f3e333815b2efda598d5e7b303e063b1a3e0d46bc5ca4ff9b490a104c402c3b3cb65a675d2a10643b487543665b1895b265f6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\error-soft\SBot AC\Images\JGlv2.PNG

Filesize
78KB

MD5
f05b7211f36241e4c3f96529cbec89f1

SHA1
2603fe7f804f53bed26bf616807c832953ee8691

SHA256
7a9b40d9f90feb0233d2168dcc39f7c53dd4b64921c3bc8eaf5d2b7486568565

SHA512
43ef120ac5a0368decfb7a4b8c02a06964d23b85025f520458fbe5973f56cc6a85c009921e2155cfc8901f5b7b334cd2633955c6e9e732751746b1695b5e9c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\error-soft\SBot AC\Images\JGlv3.PNG

Filesize
152KB

MD5
780bbae37ae64f8835bcfc132ceacec0

SHA1
e16c8c3ed68a07ee85c2a07553b494074726a32d

SHA256
ee4c776292f8f93fd5408745e437e5dc45bc8246764a0a8934945942919b8b36

SHA512
22fe86694583f788343e7da3be122d26206e2ed1509adad138ca00b2f84ed6bf7b624b7de440463e7106c1511bd3f9438dae5e1ad276cffc225a146db07504fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\error-soft\SBot AC\Images\JGlv4.PNG

Filesize
116KB

MD5
c4758a8ee121d40ae2eea8363edaac19

SHA1
c62a458dd0e086da04651a8a6231d5f5508a9829

SHA256
04108842eda5a911defe64a09253fcb38e5904395dd5815e271a100522c7f8e4

SHA512
80342e22d1ea5c104123dee5172fec876b630a3020bc1dbc6854772c84ce0283a0e6b8e7b2d7cc4d115925949411686dde9d593f8214bf2d7da7b3bd17f95bc2

Download Submit