Overview

overview

8

Static

static

eef4326b68...d4.exe

windows7_x64

8

eef4326b68...d4.exe

windows10_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eef4326b6839f48f8176aa358c7a76f136df80d4.exe

  • Size

    317KB

  • Sample

    210420-21vhbxqr7a

  • MD5

    8e57ff928f910a50c009460bd11e6050

  • SHA1

    eef4326b6839f48f8176aa358c7a76f136df80d4

  • SHA256

    6441b018905b8e4a1a048090dcc089ddfeeeea0f1c3fc607b9f44acf7d067cb1

  • SHA512

    12a7030530179597d87c11de64251ed5c0c951b256cefcd7ac41c772f473193b891fad28f2f6942bd990cd6333128645b4f87b2d74c09cd7c3184d5945ca120c

Score
8/10
persistence

Malware Config

Targets

    • Target

      eef4326b6839f48f8176aa358c7a76f136df80d4.exe

    • Size

      317KB

    • MD5

      8e57ff928f910a50c009460bd11e6050

    • SHA1

      eef4326b6839f48f8176aa358c7a76f136df80d4

    • SHA256

      6441b018905b8e4a1a048090dcc089ddfeeeea0f1c3fc607b9f44acf7d067cb1

    • SHA512

      12a7030530179597d87c11de64251ed5c0c951b256cefcd7ac41c772f473193b891fad28f2f6942bd990cd6333128645b4f87b2d74c09cd7c3184d5945ca120c

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks