Overview

overview

10

Static

static

10

6764c4f080...7e.exe

windows7_x64

3

6764c4f080...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6764c4f08019a120e1636891e05481cd226b7baa29c9b00c839161e443814d7e

  • Size

    66KB

  • Sample

    220201-bwqd3aegdl

  • MD5

    433e50ddd77998a43b7619c9d9afffd7

  • SHA1

    156fc33f237c6d92aa56386e1f72360a46b6331a

  • SHA256

    6764c4f08019a120e1636891e05481cd226b7baa29c9b00c839161e443814d7e

  • SHA512

    99bad4757042cbb745f3026546f2ec7e3b2c33910c4982eeb0e42498c680a02dabac5255f0f0c16f56cc4f4fd6ddb34597e4c8333a85a6dc29667f311210cd2c

Score
10/10
netwalkerpersistence

Malware Config

Targets

    • Target

      6764c4f08019a120e1636891e05481cd226b7baa29c9b00c839161e443814d7e

    • Size

      66KB

    • MD5

      433e50ddd77998a43b7619c9d9afffd7

    • SHA1

      156fc33f237c6d92aa56386e1f72360a46b6331a

    • SHA256

      6764c4f08019a120e1636891e05481cd226b7baa29c9b00c839161e443814d7e

    • SHA512

      99bad4757042cbb745f3026546f2ec7e3b2c33910c4982eeb0e42498c680a02dabac5255f0f0c16f56cc4f4fd6ddb34597e4c8333a85a6dc29667f311210cd2c

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks