Overview

overview

10

Static

static

95373d835e...81.exe

windows7_x64

8

95373d835e...81.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95373d835e53c643dd2294a0f14f76f79f30d0c6c782ffe55ddb4404087d4681

  • Size

    861KB

  • Sample

    210513-4hfd11h8d2

  • MD5

    6405c241b3eb593804b2c28b75d9beef

  • SHA1

    3598e3d88f0353df7b2fc498e7da63d082b76ca8

  • SHA256

    95373d835e53c643dd2294a0f14f76f79f30d0c6c782ffe55ddb4404087d4681

  • SHA512

    5d5f7fee77e11a5d7c0978ea1abed82f706137e90de309ebdf7d7cadc0142a1c0299cd557fa7bdb55d4d1e80c014bc9c94434aecd4091a3c67bfd3ac87805016

Score
10/10
persistence

Malware Config

Targets

    • Target

      95373d835e53c643dd2294a0f14f76f79f30d0c6c782ffe55ddb4404087d4681

    • Size

      861KB

    • MD5

      6405c241b3eb593804b2c28b75d9beef

    • SHA1

      3598e3d88f0353df7b2fc498e7da63d082b76ca8

    • SHA256

      95373d835e53c643dd2294a0f14f76f79f30d0c6c782ffe55ddb4404087d4681

    • SHA512

      5d5f7fee77e11a5d7c0978ea1abed82f706137e90de309ebdf7d7cadc0142a1c0299cd557fa7bdb55d4d1e80c014bc9c94434aecd4091a3c67bfd3ac87805016

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks