Overview

overview

7

Static

static

7

5dcc685124...30.exe

windows7-x64

7

5dcc685124...30.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430

  • Size

    1.5MB

  • Sample

    220731-189qxabghq

  • MD5

    92368dad3e64adca4dd3dd41f965fd30

  • SHA1

    426cd319f3843893bb0eae7e5850d56bf34b33c1

  • SHA256

    5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430

  • SHA512

    354e8e1e4c75322243ee09ef8f0ade34a68f166dc180952f6886dfa8c16e79d918d0cf9765993badbdfe026f93bfa3f8ea706f38ae0a7431b76dfdc6d2a13223

Score
7/10
persistencethemida

Malware Config

Targets

    • Target

      5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430

    • Size

      1.5MB

    • MD5

      92368dad3e64adca4dd3dd41f965fd30

    • SHA1

      426cd319f3843893bb0eae7e5850d56bf34b33c1

    • SHA256

      5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430

    • SHA512

      354e8e1e4c75322243ee09ef8f0ade34a68f166dc180952f6886dfa8c16e79d918d0cf9765993badbdfe026f93bfa3f8ea706f38ae0a7431b76dfdc6d2a13223

    Score
    7/10
    persistencethemida

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks