6928418cffb66649dbc9ceadb8fe0779a47fa2d8f1d04bf750af60ff9f781b08 | Triage

Sharing

General

Target

36182f9a5b49566562c8209c6ab366d0N.exe
Size

75KB
Sample

240716-aktrnsyfrc
MD5

36182f9a5b49566562c8209c6ab366d0
SHA1

9ab139148cfa70828e1758228ade058e090137a3
SHA256

6928418cffb66649dbc9ceadb8fe0779a47fa2d8f1d04bf750af60ff9f781b08
SHA512

8083865c2123f626635bff6379d41a06ec40398eb21171c7f43a8fc9b928292f763e8047734ecc2e3af2cd591a4480c8608126b20bf87e47406d4717c2e939fe
SSDEEP

1536:Ex1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3s:MOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPE

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  36182f9a5b49566562c8209c6ab366d0N.exe
- Size
  
  75KB
- MD5
  
  36182f9a5b49566562c8209c6ab366d0
- SHA1
  
  9ab139148cfa70828e1758228ade058e090137a3
- SHA256
  
  6928418cffb66649dbc9ceadb8fe0779a47fa2d8f1d04bf750af60ff9f781b08
- SHA512
  
  8083865c2123f626635bff6379d41a06ec40398eb21171c7f43a8fc9b928292f763e8047734ecc2e3af2cd591a4480c8608126b20bf87e47406d4717c2e939fe
- SSDEEP
  
  1536:Ex1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3s:MOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPE
Score

7^/10

persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2