General
-
Target
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3
-
Size
5.7MB
-
Sample
211028-gnr6kshebn
-
MD5
63151e4f7c3972f18a23c0e9996e14ef
-
SHA1
5d041fde6433a8ff8fc78a69fca1fd4630e3f270
-
SHA256
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3
-
SHA512
f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec
Static task
static1
Behavioral task
behavioral1
Sample
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3.exe
Resource
win10-en-20211014
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Targets
-
-
Target
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3
-
Size
5.7MB
-
MD5
63151e4f7c3972f18a23c0e9996e14ef
-
SHA1
5d041fde6433a8ff8fc78a69fca1fd4630e3f270
-
SHA256
cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3
-
SHA512
f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec
Score10/10-
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Modifies RDP port number used by Windows
-
Sets DLL path for service in the registry
-
Loads dropped DLL
-