Overview

overview

8

Static

static

266c99d540...db.exe

windows7_x64

8

266c99d540...db.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    266c99d5407fe73ceba95de2a075c0cb9c99dc5cc39f5f672b79bb4a0bc314db

  • Size

    1.9MB

  • Sample

    220520-3cs5dsbfan

  • MD5

    68f740fdaa044220dccf3bbf8eb5e3a1

  • SHA1

    2b93ae066b3d7eb344600f82deb802b00fd59c26

  • SHA256

    266c99d5407fe73ceba95de2a075c0cb9c99dc5cc39f5f672b79bb4a0bc314db

  • SHA512

    e43886967423ce28f7ea99d172639c12b157ef17695c633e9209ed28de19c78912e7b4e785534cce64e419f8d856c67e39d8f6cbfe7bb6dd7a6869be7e9255df

Score
8/10
discoveryexploit

Malware Config

Targets

    • Target

      266c99d5407fe73ceba95de2a075c0cb9c99dc5cc39f5f672b79bb4a0bc314db

    • Size

      1.9MB

    • MD5

      68f740fdaa044220dccf3bbf8eb5e3a1

    • SHA1

      2b93ae066b3d7eb344600f82deb802b00fd59c26

    • SHA256

      266c99d5407fe73ceba95de2a075c0cb9c99dc5cc39f5f672b79bb4a0bc314db

    • SHA512

      e43886967423ce28f7ea99d172639c12b157ef17695c633e9209ed28de19c78912e7b4e785534cce64e419f8d856c67e39d8f6cbfe7bb6dd7a6869be7e9255df

    Score
    8/10
    discoveryexploit

    • Contacts a large (1497) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1955) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Network Service Scanning

2
T1046

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks