6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe
Size

544KB
MD5

6f39045e190fe4cb5c7990b531cb540b
SHA1

60cdbccd6784dd66ddc6025709b535661d9b2487
SHA256

6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef
SHA512

c95158ea8c4488169cea83ba70b081ee235e2f16f7d480622f8f68bb82a2ed983273578d964c449054583373b0c0f5110346896bc6c037436d67f0522c2e7d46
SSDEEP

6144:4jlYKRF/LReWAsUyoXLp9L/SYNQsTGDX1saNCVQlEqKqhBJKEEvrkWbfeogdTZ:4jauDReWuFBw1BNGQl1K8EvrkWbRg1Z

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	brlrqt.exe

Loads dropped DLL 2 IoCs

pid	Process
2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe
2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\brlrqt.exe"	brlrqt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2072	2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe	28
PID 2792 wrote to memory of 2072	2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe	28
PID 2792 wrote to memory of 2072	2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe	28
PID 2792 wrote to memory of 2072	2792	6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe	28

C:\Users\Admin\AppData\Local\Temp\6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe
"C:\Users\Admin\AppData\Local\Temp\6adcc56237320fcbac145fa0dd1325588bab63edc95118d99bc324bdc1d10bef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792
- C:\ProgramData\brlrqt.exe
  "C:\ProgramData\brlrqt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
544KB

MD5
d60cddd56c837791f811b56395fc2549

SHA1
ad186df9d9ec234f54f34d78c62127e011373051

SHA256
abe03e80b53d9d7f80b93df211ad4cda9b28ae1b62785ef4e1c61bf40798a17c

SHA512
9389f9fac9356dbd0ebdc9900d694cc09d09df3d4669e4783e64ede77f2e23ec7d2e9e813949fc85fd79b6861b672d7d6e2bc95595389fee237e2bccc74c3a37

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\brlrqt.exe

Filesize
407KB

MD5
030e0a1c3c71a6b1057185a71d106c5a

SHA1
e76e44f50108299f8d2e63450954a87326c02142

SHA256
52a2cf77203cf972255de69c3ac7cafbad099c910372f3966a00d484c1bff97d

SHA512
e9c7d93c86932711a6305d5a391fc103fc56e09f790e80d11856b1d354b5ec3e52a5419f0f3469a1e4d8e700c7aa814a4168243d0889a5916b45accf0e63130e

Download Submit
memory/2072-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2792-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2792-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2792-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads