Overview

overview

10

Static

static

10

c76eaa1700...99.dll

windows7_x64

3

c76eaa1700...99.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

  • Size

    48KB

  • Sample

    220201-pt5b4aebdn

  • MD5

    9f4863dc7d3ced05539183ddcb0a2f88

  • SHA1

    5bfa025daa3724b7aaae25ceefb8e3166703c042

  • SHA256

    c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

  • SHA512

    cfa8dc9f7816841a87ae1ef31a8d440f5881a5c4c066fbc097f5d654c02584081453499026764fcd723db6f6cb3a64e67e50da8e9b41b8814ef336022bf8072c

Score
10/10
doublebackpersistence

Malware Config

Targets

    • Target

      c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

    • Size

      48KB

    • MD5

      9f4863dc7d3ced05539183ddcb0a2f88

    • SHA1

      5bfa025daa3724b7aaae25ceefb8e3166703c042

    • SHA256

      c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99

    • SHA512

      cfa8dc9f7816841a87ae1ef31a8d440f5881a5c4c066fbc097f5d654c02584081453499026764fcd723db6f6cb3a64e67e50da8e9b41b8814ef336022bf8072c

    Score
    10/10
    persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks