Overview

overview

10

Static

static

10

801a29eaa6...ef.exe

windows7_x64

10

801a29eaa6...ef.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    801a29eaa6d4d9950c3fe052d80fc460051ab46ad903b790b023eaaefb9d1eef

  • Size

    15.2MB

  • Sample

    210508-rbph38tsxa

  • MD5

    2e9b6e62d835b5d56dccffc04f31de01

  • SHA1

    ad9353c4df2013abbe336f481af65bbdd04bb228

  • SHA256

    801a29eaa6d4d9950c3fe052d80fc460051ab46ad903b790b023eaaefb9d1eef

  • SHA512

    1362509330ea42ec1e43756ff241546dba0217a01977aacb4f7058eeab1f58a94211ee7136f6e6996d09258f3719af111440ffa371e2245ce664acfd21e529db

Score
10/10
guloaderevasionguloaderpersistence

Malware Config

Targets

    • Target

      801a29eaa6d4d9950c3fe052d80fc460051ab46ad903b790b023eaaefb9d1eef

    • Size

      15.2MB

    • MD5

      2e9b6e62d835b5d56dccffc04f31de01

    • SHA1

      ad9353c4df2013abbe336f481af65bbdd04bb228

    • SHA256

      801a29eaa6d4d9950c3fe052d80fc460051ab46ad903b790b023eaaefb9d1eef

    • SHA512

      1362509330ea42ec1e43756ff241546dba0217a01977aacb4f7058eeab1f58a94211ee7136f6e6996d09258f3719af111440ffa371e2245ce664acfd21e529db

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks