Overview

overview

10

Static

static

10

b1e703bd4d...02.dll

windows7_x64

1

b1e703bd4d...02.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02

  • Size

    138KB

  • Sample

    220201-l1qkqsdba8

  • MD5

    fb82ccc8e504fe065fb785e4cfdd440a

  • SHA1

    14e9d68bba7a184863667c680a8d5a757149aa36

  • SHA256

    b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02

  • SHA512

    d1e50c1bf8cc9e95d55c99085e93dc51655cd4a9f940115f13ddd0c19b9be8e088353adadd261673a33969e7d9b1632376d6106fdaf1f0d2067fad0f8bdf517c

Score
10/10
anchordnsbackdoorpersistence

Malware Config

Targets

    • Target

      b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02

    • Size

      138KB

    • MD5

      fb82ccc8e504fe065fb785e4cfdd440a

    • SHA1

      14e9d68bba7a184863667c680a8d5a757149aa36

    • SHA256

      b1e703bd4df1d3e85ff97b638357b8c96360c9a658930473d37b733dbed51e02

    • SHA512

      d1e50c1bf8cc9e95d55c99085e93dc51655cd4a9f940115f13ddd0c19b9be8e088353adadd261673a33969e7d9b1632376d6106fdaf1f0d2067fad0f8bdf517c

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks