be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6
Size

713KB
Sample

240912-qaah2swdlk
MD5

a65f39014391ca9618a3797b7db107b6
SHA1

1c026203d4491fa9e32dea9446dceb897e9678c0
SHA256

be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6
SHA512

af3b71dccef99596e1a7aa7d73e65217d9905b2b7cb5b2e783ea379f41af001f8f198a0e74484ec747afd2eb10b3596af58191d8fa511ec39380cdaf52ce51d8
SSDEEP

12288:x2JylsKTLW4VyPGDSBQkoZnkDfRgn9gkinRNh4uHF:x2Jyxu4VR7ofGRYhHl

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6
- Size
  
  713KB
- MD5
  
  a65f39014391ca9618a3797b7db107b6
- SHA1
  
  1c026203d4491fa9e32dea9446dceb897e9678c0
- SHA256
  
  be49acc8e07594e0ed24f5f033df97b0770926909543bb054d98aae03c3bf7a6
- SHA512
  
  af3b71dccef99596e1a7aa7d73e65217d9905b2b7cb5b2e783ea379f41af001f8f198a0e74484ec747afd2eb10b3596af58191d8fa511ec39380cdaf52ce51d8
- SSDEEP
  
  12288:x2JylsKTLW4VyPGDSBQkoZnkDfRgn9gkinRNh4uHF:x2Jyxu4VR7ofGRYhHl
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence