Overview

overview

9

Static

static

INV-009484_PDF.exe

windows7_x64

9

INV-009484_PDF.exe

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    INV-009484_PDF.exe
  • Size 1.0MB
  • Sample201026-awkzyzcwls
  • SHA256 703aadea111eae71a7dfb3f2c63c4522b4edd138033fef221295f74d3509e10a
  • MD5 SHA1 SHA512
Score
9/10
evasionpersistence

Malware Config

Targets

    • Target
      INV-009484_PDF.exe
    • Size 1.0MB
    • SHA256 703aadea111eae71a7dfb3f2c63c4522b4edd138033fef221295f74d3509e10a
    • MD5 SHA1 SHA512
    Score
    9/10
    evasionpersistence

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies service

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks