Overview

overview

10

Static

static

153c4863fe...72.exe

windows7_x64

8

153c4863fe...72.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    153c4863fef90fb2e1d89aed48deab4c740ef8b54c39f0fdb4b2f3f8556ff772

  • Size

    4.7MB

  • Sample

    220419-qwf8qaecc6

  • MD5

    178e442aa91768f00d754b395bb5c89e

  • SHA1

    ff7ea0a36080deb166178b7fca97d33955d55dfa

  • SHA256

    153c4863fef90fb2e1d89aed48deab4c740ef8b54c39f0fdb4b2f3f8556ff772

  • SHA512

    2db61a73bc22cc283aee3bdb8420ca9f5617869afa1df74fc8672c7fce9ac014ead0be496de8bfa7764f4ba5288b6f87db142d4791a505a969daea95df7cbca6

Score
10/10
servhelperbackdoordiscoveryexploitpersistencetrojan

Malware Config

Targets

    • Target

      153c4863fef90fb2e1d89aed48deab4c740ef8b54c39f0fdb4b2f3f8556ff772

    • Size

      4.7MB

    • MD5

      178e442aa91768f00d754b395bb5c89e

    • SHA1

      ff7ea0a36080deb166178b7fca97d33955d55dfa

    • SHA256

      153c4863fef90fb2e1d89aed48deab4c740ef8b54c39f0fdb4b2f3f8556ff772

    • SHA512

      2db61a73bc22cc283aee3bdb8420ca9f5617869afa1df74fc8672c7fce9ac014ead0be496de8bfa7764f4ba5288b6f87db142d4791a505a969daea95df7cbca6

    Score
    10/10
    servhelperbackdoordiscoveryexploitpersistencetrojan

    • ServHelper

      ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

      trojanbackdoorservhelper

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Executes dropped EXE

    • Modifies RDP port number used by Windows

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Remote Desktop Protocol

1
T1076

Collection

Exfiltration

Command and Control

Impact

Tasks