2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8

General

Target

2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
Size

1.1MB
MD5

67c79338802019b7b9d62e72f69b054c
SHA1

daad76f2f6d45d17ace9ba27a6ce7ff86493ccf9
SHA256

2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8
SHA512

ca35522098bd598e7c862e5c9d606acea756071d8cb99fa6cc8d720bbed900857732f08b9409cb3f604e4bffc1ebf6bace9c5a390a42747f2007ffac1ab56b52
SSDEEP

24576:vkeCNtI0aTJg42guvyNczB2SN8URYqxeN9o3KPzdrAjoE7IH1iIH1M:8YL2xy48SdYqxeN9kKxrAjoEUHDH+

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\P:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\S:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\T:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\I:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\K:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\N:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\O:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\X:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\E:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\L:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\Q:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\U:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\V:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\Y:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\Z:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\A:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\G:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\H:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\J:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\M:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\R:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
File opened (read-only)	\??\W:	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe

C:\Users\Admin\AppData\Local\Temp\2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
"C:\Users\Admin\AppData\Local\Temp\2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-4-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2372-6-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-8-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-9-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-10-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-11-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-12-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-13-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-14-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-15-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-16-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2372-17-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing