Overview

overview

10

Static

static

4901558e82...e6.exe

windows7_x64

6

4901558e82...e6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4901558e82430e4a21b5fbf6615d76e02bb7a0941e4c7f3dd92293f6f65ffce6
  • Size 668KB
  • Sample210906-hhm54sdgbr
  • SHA256 4901558e82430e4a21b5fbf6615d76e02bb7a0941e4c7f3dd92293f6f65ffce6
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistencesuricata

Malware Config

Targets

    • Target
      4901558e82430e4a21b5fbf6615d76e02bb7a0941e4c7f3dd92293f6f65ffce6
    • Size 668KB
    • SHA256 4901558e82430e4a21b5fbf6615d76e02bb7a0941e4c7f3dd92293f6f65ffce6
    • MD5 SHA1 SHA512
    Score
    10/10
    persistenceevasionsuricata

    • Modifies firewall policy service

      evasion

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup

      suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup

      suricata

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks