5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782c | Triage

Sharing

General

Target

5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe
Size

127KB
Sample

250120-k2thca1rbx
MD5

5cea0594d8f2182442ce40d6933543c0
SHA1

441d79a32e498c90c6e54296a2311d39a0161299
SHA256

5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782c
SHA512

6c7c0b8dac97f4f0edb03bb33fe35ac917fa69b406251a82705cfdef5e05388f60b30bb69d02d3a23b8e3cabbbcb0d6b98d44e3368e898d1edc223b39241cf62
SSDEEP

3072:9OjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPz:9IH9OKofHfHTXQLzgvnzHPowYbvrjD/e

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe
- Size
  
  127KB
- MD5
  
  5cea0594d8f2182442ce40d6933543c0
- SHA1
  
  441d79a32e498c90c6e54296a2311d39a0161299
- SHA256
  
  5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782c
- SHA512
  
  6c7c0b8dac97f4f0edb03bb33fe35ac917fa69b406251a82705cfdef5e05388f60b30bb69d02d3a23b8e3cabbbcb0d6b98d44e3368e898d1edc223b39241cf62
- SSDEEP
  
  3072:9OjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPz:9IH9OKofHfHTXQLzgvnzHPowYbvrjD/e
Score

7^/10

discovery persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence