cf2e4f5e87e7ad3bb1c8260be3b16feeccfd19f89ee24b00c3eee45f1f6ed8c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf2e4f5e87e7ad3bb1c8260be3b16feeccfd19f89ee24b00c3eee45f1f6ed8c1
Size

34KB
Sample

220919-p6s5lahga4
MD5

739e56369e2f199cec4740fc0ec37a7f
SHA1

357df2014988b1e9dec9065aa53a4ac219c8dcf1
SHA256

cf2e4f5e87e7ad3bb1c8260be3b16feeccfd19f89ee24b00c3eee45f1f6ed8c1
SHA512

a54d3ffd1babd0ed09d76d578e781a0d39a0a590915e87f36e4545e09bf613041615e6df8e42e3c7234f00b661afc99f777c0bb2ce7b3bfb24d327d4f49910fc
SSDEEP

384:WhjGjlyVFG99anPznIacC3t56I6mvu61z3xYGTN+YsIYXI8Y24h6qQ2:WplGDI1cC3t5tz3+Gpsr+h60

Score

7^/10

Malware Config

Targets

- Target
  
  cf2e4f5e87e7ad3bb1c8260be3b16feeccfd19f89ee24b00c3eee45f1f6ed8c1
- Size
  
  34KB
- MD5
  
  739e56369e2f199cec4740fc0ec37a7f
- SHA1
  
  357df2014988b1e9dec9065aa53a4ac219c8dcf1
- SHA256
  
  cf2e4f5e87e7ad3bb1c8260be3b16feeccfd19f89ee24b00c3eee45f1f6ed8c1
- SHA512
  
  a54d3ffd1babd0ed09d76d578e781a0d39a0a590915e87f36e4545e09bf613041615e6df8e42e3c7234f00b661afc99f777c0bb2ce7b3bfb24d327d4f49910fc
- SSDEEP
  
  384:WhjGjlyVFG99anPznIacC3t56I6mvu61z3xYGTN+YsIYXI8Y24h6qQ2:WplGDI1cC3t5tz3+Gpsr+h60
Score

7^/10
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2