b630d7dfd30e2303c588a56c804585b2b3dacbb82398008ef35ebf44fd9b3774 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b630d7dfd30e2303c588a56c804585b2b3dacbb82398008ef35ebf44fd9b3774N
Size

2.3MB
Sample

241004-eh5tdatark
MD5

103de6474a918279949683de3c70bff0
SHA1

f8e1d1ca586033feca5902004773f1ea91abe24b
SHA256

b630d7dfd30e2303c588a56c804585b2b3dacbb82398008ef35ebf44fd9b3774
SHA512

510dab675a0be6a2c51cc8475ae0cec334e773148f8589e7bedb2ba8a37fe777651ff876276290d85cda0c94277b4fbc81999c05318d884cf3b2df542eb264fe
SSDEEP

49152:Pjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:PrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b630d7dfd30e2303c588a56c804585b2b3dacbb82398008ef35ebf44fd9b3774N
- Size
  
  2.3MB
- MD5
  
  103de6474a918279949683de3c70bff0
- SHA1
  
  f8e1d1ca586033feca5902004773f1ea91abe24b
- SHA256
  
  b630d7dfd30e2303c588a56c804585b2b3dacbb82398008ef35ebf44fd9b3774
- SHA512
  
  510dab675a0be6a2c51cc8475ae0cec334e773148f8589e7bedb2ba8a37fe777651ff876276290d85cda0c94277b4fbc81999c05318d884cf3b2df542eb264fe
- SSDEEP
  
  49152:Pjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:PrkI9rSjA5aDo73pzF2bz3p9y4HgIoov
Score

7^/10

discovery persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence