Overview

overview

10

Static

static

6da69b16ca...cd.exe

windows7_x64

10

6da69b16ca...cd.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6da69b16cadbcc125175b5e4ab8520cd
  • Size 99KB
  • Sample210914-te3beafhh4
  • SHA256 7263fbdb7378bb2a4522bae58a388d74b193bd2d73a8669f901d11e1481a1595
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Targets

    • Target
      6da69b16cadbcc125175b5e4ab8520cd
    • Size 99KB
    • SHA256 7263fbdb7378bb2a4522bae58a388d74b193bd2d73a8669f901d11e1481a1595
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks