43c249dfb8ffd894491afd260e9ee0d134420aa3d39a352e117d14a3a7b7f4ed

Sharing

Copy URL Twitter E-mail

General

Target
BocAvenue.exe
Size 1.9MB
Sample260816-pnx1tsar2y
SHA256 43c249dfb8ffd894491afd260e9ee0d134420aa3d39a352e117d14a3a7b7f4ed
MD5 bce3ff1f7807ff80efd22f59f1b963f7
SHA1 74cd2d4c3b0aaa859c3ff5cc1b6e22e2acfdfe09
SHA512 e9e4ec435a85548cfefd7f0ba761e07124189c75217bc52697ce5b836d9c5c457d45fcd144fdadeedfcc96671bf1531fc09eaa5f356a621b300e10044b284750
SSDEEP 49152:8EbhmvozH321JF/pBqbOlHpSndZZt6DtxWqY8JQxuz:798ozXinpQbwpSndZZkCwJQxk
TLSH
T1D69533813520A81CCDC39F722EB1DA511A39FA4E55F68F3A9F128EDFA41468ED510F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  BocAvenue.exe
- Size 1.9MB
- SHA256 43c249dfb8ffd894491afd260e9ee0d134420aa3d39a352e117d14a3a7b7f4ed
- MD5 bce3ff1f7807ff80efd22f59f1b963f7
- SHA1 74cd2d4c3b0aaa859c3ff5cc1b6e22e2acfdfe09
- SHA512 e9e4ec435a85548cfefd7f0ba761e07124189c75217bc52697ce5b836d9c5c457d45fcd144fdadeedfcc96671bf1531fc09eaa5f356a621b300e10044b284750
- SSDEEP 49152:8EbhmvozH321JF/pBqbOlHpSndZZt6DtxWqY8JQxuz:798ozXinpQbwpSndZZkCwJQxk
- TLSH
  T1D69533813520A81CCDC39F722EB1DA511A39FA4E55F68F3A9F128EDFA41468ED510F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH
  T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  AttendingHabits/Amber.ppsx
- Size 291KB
- SHA256 7197bfcf08c97c888fbc96032269741c678ec38412f863bf58d545132af74007
- MD5 981d72c28175d47d1ce909fc07a21fb5
- SHA1 76d8a48bce5f9e98bc39022bc58772d8a2a7f0c9
- SHA512 22db24f49caf4d04b0c41b5d8007bf418eb4a2fecf9d070b8dac14b1b1c52fd1bd721a51d01d6e0bfc9c344e7fab5bc6a913a62e3f4989f33803bd169ae51edf
- SSDEEP 6144:KrYYVN8dChNdZzmhTE/SDd24nF5A6KyyY7DgwKhjezKFhBwKj6YZ/y:KHCCNdZ+d24v/KLdw9zKFRzZ/y
- TLSH
  T1425423B11761CDAF05A699B6D3F369C87C3E319950E51D20CA188FDD6BAA39F3C20498
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  AttendingHabits/Cc.ppsx
- Size 276KB
- SHA256 4786c6722a34f243bed32bb6eca5ddca6865b2aee2a4e41cd0da970b250557fa
- MD5 a0836d3bb49fb0f3df4b7653ca9fa2e0
- SHA1 99ed32d60e93fbb09dca49433fdd7ba1008d47f4
- SHA512 83ce2e8175da56b3e84803f62a32e4dd1cba2e62d9334466ceb6593bb6f9e0ea7d975d179fd9ed16fdd11f36124723725e47ab416460fd84df6c9d3c05f75a5a
- SSDEEP 6144:0uTCdhgbXlZXl/MbJGOhnnDZPWEnFqspaw+iAm0u5DfgapAkaW0pe:JTe0JVA0Ohnl+EF70wAm0cwW0s
- TLSH
  T1C45423E4FD71BC9099439A8CE0409730F23EAE8B75FE0F9947107EA5E90DD9B7909960
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  AttendingHabits/Expenditure.ppsx
- Size 131KB
- SHA256 852a1feb68900270dad3360a2158af02d53ae925ce298de6f1808b2a15cb4bfa
- MD5 df0a97d6d5a28a4ca7e6c67de2391356
- SHA1 85dcb185b260c1b8b3474152ffbf345c4be698c9
- SHA512 2371503beb077036590d6a43a0fd9a0d8f9c868309667b4e19790ca21294162403d2fb73e58f08868bb3154e773fd24594b2a2f4d6a2901ffc9887bb5e733cb4
- SSDEEP 3072:Lcwhun0if9e8jVHtaj2XFaeZiShuR/D3vR5XAi3sB6:4xPf9rjptaiXFtZgl3v4XM
- TLSH
  T144D3133CAA210C10CC285F5A0F9DE0F982554F2CE506ED7D9859FADF66CF28625073E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  AttendingHabits/Feels.ppsx
- Size 28KB
- SHA256 5afd2080a99fc3f0f3c9a7843aeb61a43832ed2a070ed7a0dd47bfb16fa38628
- MD5 3df48cab03eeb5dd9d1970e45fa5a98b
- SHA1 5bf45ea7fbe5d44080bf17182dc8d3f14689467e
- SHA512 9a56f0603297add3a68479565e9f09e2e4aec8dc7506ad39f37c63e8aed5509212a051eb9db7e7421c50b3b8318245fb8073b533af0612ef85f8c567670e95e1
- SSDEEP 768:7Gr/YUbeUYdP0Zfgh90rlQuwPBuHiWkDvd8:yrrbFKMZfKvPBGiWT
- TLSH
  T1DAD21AF4B1893812756BB1B3ABA429957632C3251931109E9FEB4BCE9698C5C0337F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  AttendingHabits/Known.ppsx
- Size 198KB
- SHA256 3d2a52d7b2516cedf1a9cc2c7594911479850b8c49763a0794263f23d7deb197
- MD5 8eaf23e0493ea197376814fba7a02862
- SHA1 a0e09645508297ccafd9f8cc4b9c61183ce8183b
- SHA512 314c6cb5905c1b7427733a853a2caa3d07ff2a0f85984335abe8d451b0902193aa2eb62020b28f5d1c64649e583987afc82af3510ccd4d4ce89655daa436db9a
- SSDEEP 6144:NG/09JNm/WebZ6PWPZBWEnb8rTIPLqWs/1iQwDL:As9Jk/xhWe8HIPebsDL
- TLSH
  T1861422A528A0ADCD37CB17620C646D121014E7888B171743BE674ED72F5ADCC7BCAEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  AttendingHabits/Lbs.ppsx
- Size 218KB
- SHA256 1e116c456c3c29a449a748d051ef3b1c45a1497adf793214875c2e61f7e9d260
- MD5 920a918f473472d5525de0d0f4153afa
- SHA1 b69b23aa96eea1507490d9394cc3e7dfb8936d3c
- SHA512 32dccfa082402d5a537a71adca46ed1768d5eff736b09a6b822d0e578081b86d5e813df869dcdc84a4504eba488ad7d5cf2b66395f6635721d2ebb8dfdd9ef11
- SSDEEP 6144:07n9N8cqWlpgDTZZBk5J/knIR0zV/CEQXRag5z:0DqymDry5J/OZkX/F
- TLSH
  T1BA2422A71800F9116C038C5A1F6E9070AA2BDFEB79A71CFA1D97D4F2842496CD23F957
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  AttendingHabits/Vol.ppsx
- Size 230KB
- SHA256 6b2fc5558dd63827f5f35018eee9621570f6d607e1503e831c0464b066255e7f
- MD5 f21dd2c7827bebed46b5b331dd89ab73
- SHA1 57fb519594beea8d50d09905bdcb33fdf1d7cc7d
- SHA512 10bc97f18c41f5da4011d90357ec094ef7b49040bc2581ade455bce56b59c49d50e8aa9622433b50e37f734234f2fb056d308b2bca02ca7217ae749cd0cca870
- SSDEEP 6144:zoR39aJZnRw6CDLXdOWqxH/FzfEK6pheLPNUk7n:URtaJvwlDx+/ZxUheNL
- TLSH
  T17C3423879277E4282EE8C83B61839F6B0F5785DBB34670F59A4FE532F804661A170C5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18