Overview

overview

9

Static

static

8bea4f035c...05.exe

windows7_x64

8

8bea4f035c...05.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bea4f035cf4c326ee29d659c87d6c05

  • Size

    11.1MB

  • Sample

    201117-pqv3hxv9bs

  • MD5

    970751ae473a2ed45e6f0571a1d8541d

  • SHA1

    641e74d7430e2854c0e3cb1bec69a003da8f7079

  • SHA256

    966fc4bb79e63ab27222a3a13a7617415b4cd4642df4b15c5a19095a2775f3d6

  • SHA512

    d8d01167de369757128b3b31299d6b0801994f2390829d8494ea48fdc58ea76c83c99ef29eb5082a9446af4db49c11a35e933eb05ebfa444f28608368b16a0a8

Score
9/10
discovery

Malware Config

Targets

    • Target

      8bea4f035cf4c326ee29d659c87d6c05

    • Size

      11.1MB

    • MD5

      970751ae473a2ed45e6f0571a1d8541d

    • SHA1

      641e74d7430e2854c0e3cb1bec69a003da8f7079

    • SHA256

      966fc4bb79e63ab27222a3a13a7617415b4cd4642df4b15c5a19095a2775f3d6

    • SHA512

      d8d01167de369757128b3b31299d6b0801994f2390829d8494ea48fdc58ea76c83c99ef29eb5082a9446af4db49c11a35e933eb05ebfa444f28608368b16a0a8

    Score
    9/10
    discovery

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks