Overview

overview

10

Static

static

f8e6d9646b...86.exe

windows7_x64

8

f8e6d9646b...86.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe

  • Size

    123KB

  • Sample

    210420-vp6qchbh6n

  • MD5

    4f0abd7211e5bcb49a92591158d4d231

  • SHA1

    f8e6d9646bf17d37f2aad9f5b82212f90f67b886

  • SHA256

    b11f8065c37558a54799f1965283968f05754cd63328560148f59d54ed77351c

  • SHA512

    3e5369dfd10eee1c0f456cd7aa94e095d289f9895f67046df25cac5294b7d6dde897fdc59425c8cd75c61ef6285ef5b645bc7a5f2d5de6b7f6a174bac70ee8fc

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe

    • Size

      123KB

    • MD5

      4f0abd7211e5bcb49a92591158d4d231

    • SHA1

      f8e6d9646bf17d37f2aad9f5b82212f90f67b886

    • SHA256

      b11f8065c37558a54799f1965283968f05754cd63328560148f59d54ed77351c

    • SHA512

      3e5369dfd10eee1c0f456cd7aa94e095d289f9895f67046df25cac5294b7d6dde897fdc59425c8cd75c61ef6285ef5b645bc7a5f2d5de6b7f6a174bac70ee8fc

    Score
    10/10
    evasionpersistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks