Overview

overview

10

Static

static

5

00e3a90b4e...24.exe

windows7_x64

10

00e3a90b4e...24.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00e3a90b4ee0f42804438613af3198e1d42cd5a35d6d83186fb048f60de4c124

  • Size

    870KB

  • Sample

    220524-elplkafah3

  • MD5

    588be75f7ceb82915980b2f90be3c4ac

  • SHA1

    65d5912f2e9b8a16989c72c4e943c2e1ecc014ee

  • SHA256

    00e3a90b4ee0f42804438613af3198e1d42cd5a35d6d83186fb048f60de4c124

  • SHA512

    b8737dd5a3bda3ee0a6476c46fcfaf688c5d3fe2067117dec90206896e095d8fc0ed91425acd397b3efdebe42c6c43051d9ffc6c51e505b3f66a49a73a51c99b

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      00e3a90b4ee0f42804438613af3198e1d42cd5a35d6d83186fb048f60de4c124

    • Size

      870KB

    • MD5

      588be75f7ceb82915980b2f90be3c4ac

    • SHA1

      65d5912f2e9b8a16989c72c4e943c2e1ecc014ee

    • SHA256

      00e3a90b4ee0f42804438613af3198e1d42cd5a35d6d83186fb048f60de4c124

    • SHA512

      b8737dd5a3bda3ee0a6476c46fcfaf688c5d3fe2067117dec90206896e095d8fc0ed91425acd397b3efdebe42c6c43051d9ffc6c51e505b3f66a49a73a51c99b

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks