Analysis
-
max time kernel
28s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/07/2024, 10:49
General
-
Target
Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.exe
-
Size
16.1MB
-
MD5
bc086f1a4caf0a29cb4fca70338ae480
-
SHA1
ed5dcbfda06df7fec77fa1c01df9a5a3c3e22a83
-
SHA256
e45a0747468178e7d3518ece3569536ace50b50267839f0f381b4e00e02378e8
-
SHA512
89e3a019e7791807e71af6c6f40bd5633e02f62ccb151fc87c3ce0a7ab3c02a0e08a7d32d0287433e86985c4d2b8512ff2fd484c4aa5be99532a62543c559d76
-
SSDEEP
393216:45vj/jsu+XRnjKMGLbPxmo3dcXZQvNOG44+HaGezRMh:4Nj/jshXRjm44YWvNm4+ZeFo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Program Files directory 45 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.exe"C:\Users\Admin\AppData\Local\Temp\Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RVO4N.tmp\Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.tmp"C:\Users\Admin\AppData\Local\Temp\is-RVO4N.tmp\Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.tmp" /SL5="$E003E,15775861,822272,C:\Users\Admin\AppData\Local\Temp\Sugar.Bytes.Effectrix.2.v2.0.3-TeamCubeadooby.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48B
MD50e903c9111f1570df8c8cddb04230cdf
SHA1f1164945ea8a01edba0c4a17b26193286920921e
SHA256a1eb16b390198bf48c7a891c6efb5358a56713834ded6a6ee485450d4c261276
SHA5120d0914a57c440d5695941b35b2ba40e42a9579e029e525cb7acfdfbb5f2d9cca2259b3e22c7980e3ea3193706a43ae0d1b8a2a5bb85516517868bef20620f5c2
-
Filesize
24KB
MD54fa6349c8f8a70ed26023bd5e6adcd7a
SHA10b0dcc840bb0ea7cb944800f5fee4f7afe4407d7
SHA256140780f0701417325e9e5e5650453659b21639b146f3abe7fd5b5ddbe6718492
SHA51248b10a5ee5f92ecff3fb3af178f12fadfd3cdbfe543842dd55667b75e90d6d4f8453360e1761c237193f0542c826b601427456b8c5a857acf12f68084e95ff81
-
Filesize
12.9MB
MD58c17c564a633ad176f7036f5a4f7482f
SHA1211b1d050b79ee050dfcbf4220be12de1576e2ef
SHA256a5d96eb5b803b9faab347a354468fbcb5a5a3396587ad2975db8a5e16e70274b
SHA512df1b80797303d3a0c163d5be5ad70ccfc2108c7c70f0854443f3d0b341ef3d7260af5412a7fa29fdeb01fc3b2baec3c31eb8cdbd2d9713714e7bffb54ac88a92
-
Filesize
2.9MB
MD5be86680cb14f3c1442b191e95262224a
SHA19a6db75a9216cc0529163593ecb67f607f9422e7
SHA2566a71cf57dce55e0d063cc4b320863ebb4b2f63d9ce1c2df7f6105d54e0779a5d
SHA512281cbdfca8f28afd130916c580b021d70a78e04e48e294390682aae4e3dd95c0d8e50823acd5297d5051b16a2f39f0ba6ab91d3f8f7638f167ce03367ea32da4
-
Filesize
44KB
MD5f90d7d75f4e7efb421d7951427747fbe
SHA10aa79c8caad7f4762371618f57786b080e5c32e7
SHA256289e4cfc31197aa599cf2254d6af83277476ac05aa6178c1afa0872e6ba1b206
SHA51206b42fa067348c6a9f75d36f11e0289c1c89ebd66ba2b9bf10d31e24f2329b94e064c0b1947cbfd9c70a91241c5b3f1f445bea180486db42a57d8dbcc097d6ac
-
Filesize
3.0MB
MD5e9903969e9086848582a0a10987165cc
SHA14ac588c40248b983336cce2fbc830b0bf5b81add
SHA256478df61aa665c7b8120e7766b7fdbf60c08a575fae060f61b8fcee75daae8fe7
SHA512d630dc499041e52ae080ab7915d4b78943e3f36c49d31d4da57972f118991cf16f619862ae56a824d3edb9fe2b76a315edcbbc34c8da14a5f9bddfaa2f9e60eb
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
856KB
-
Filesize
728KB
-
Filesize
856KB
-
Filesize
856KB