459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83b | Triage

Sharing

General

Target

459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe
Size

76KB
Sample

241121-nsejlssdrm
MD5

c5f54aa98d9b341b2ceb83459528d460
SHA1

b8beb5f15111a45804d6f596fe7438eba9d7d6e5
SHA256

459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83b
SHA512

ad9f4eda59744723c19dd808efac0d95b2f843162fa874a348e9340e3c65aaccf347d58d71c589fee25acede4381f5f9815cc46567e70097785f61c28ca9b7c3
SSDEEP

768:lembNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk6:Lnqdu3abBGy3G8V0iuoi

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83bN.exe
- Size
  
  76KB
- MD5
  
  c5f54aa98d9b341b2ceb83459528d460
- SHA1
  
  b8beb5f15111a45804d6f596fe7438eba9d7d6e5
- SHA256
  
  459fb0c452217afee2803047c10b9984ba9deba396e491368a6d57e0a0c6e83b
- SHA512
  
  ad9f4eda59744723c19dd808efac0d95b2f843162fa874a348e9340e3c65aaccf347d58d71c589fee25acede4381f5f9815cc46567e70097785f61c28ca9b7c3
- SSDEEP
  
  768:lembNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk6:Lnqdu3abBGy3G8V0iuoi
Score

10^/10

discovery evasion persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence