General

  • Target

    be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

  • Size

    171KB

  • Sample

    220924-merfksbaf7

  • MD5

    2dce3da05acacdf790a0e200206fc921

  • SHA1

    8adc6bc3612ce098a230681655cc4a8eaa0338d4

  • SHA256

    be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

  • SHA512

    762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

  • SSDEEP

    1536:GVS32qHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHU//rT//j:LVMMMZMMMMMMMMMMMMz

Score
8/10

Malware Config

Targets

    • Target

      be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

    • Size

      171KB

    • MD5

      2dce3da05acacdf790a0e200206fc921

    • SHA1

      8adc6bc3612ce098a230681655cc4a8eaa0338d4

    • SHA256

      be39930e3c2ce1f2feb23d382557b3d69d92630909ca0b54cab6b48247521f7d

    • SHA512

      762bf52c8ba86d7e4d6ca5aafaa94fefbe4ed23eb07e01e30620c52e00cc9a7d94b36042b4098ddd0c2bb01b84553d2a0d365e2db1fab6a0d1ad7344d38d9c7a

    • SSDEEP

      1536:GVS32qHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHU//rT//j:LVMMMZMMMMMMMMMMMMz

    Score
    8/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks