Overview

overview

8

Static

static

aaeb41df19...0f.exe

windows7_x64

8

aaeb41df19...0f.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aaeb41df199f1f1ff43ea44a9e70977fd66b050903fd9ed63c08fd74f331530f.zip

  • Size

    61KB

  • Sample

    210722-ndppl3tc66

  • MD5

    185a42b1751c6dc0400fe4b95641d76a

  • SHA1

    406c1bd8ab7b071e800040e40284333c213488e6

  • SHA256

    1aff8c8fc2bc03ccd0023e9e6b63075f9bd7cd856b13f6f3d8ed6ef9a0c88acb

  • SHA512

    7186e564e94fdc5757e2b853b7364c57ef9d1c2271a304feffc7b28f8cdcb8c94d0e9eeb1a2c2417256e7f8b2dde6a8ba7092f8739a69080a71cca43801e4513

Score
8/10
persistence

Malware Config

Targets

    • Target

      aaeb41df199f1f1ff43ea44a9e70977fd66b050903fd9ed63c08fd74f331530f.exe

    • Size

      161KB

    • MD5

      7192c0bd9f8bc32f896405258120c991

    • SHA1

      a85b84c35c3178c50dd22e77a0f3872158b16208

    • SHA256

      aaeb41df199f1f1ff43ea44a9e70977fd66b050903fd9ed63c08fd74f331530f

    • SHA512

      2382ce453b1299c5e6765faf9e800baceec93b23ce05443dc726f15f515003bc17d41e4ed4c236566ab802a2647e4021ebd5c612d4c51a1d02dcbedf553e3c36

    Score
    8/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks