Overview

overview

10

Static

static

599c80032f...df.exe

windows7-x64

10

599c80032f...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    599c80032f4a73b265d4204937e3a149b28faec51b90e10a9b5afa659bff05df

  • Size

    277KB

  • Sample

    221001-2nr6ssafb5

  • MD5

    037a3f857f2e74c51ed44784bc038737

  • SHA1

    92a8b2e0e4d2f94d9fc9737abafadb7f6c9a547b

  • SHA256

    599c80032f4a73b265d4204937e3a149b28faec51b90e10a9b5afa659bff05df

  • SHA512

    4fea7d836b46e2ce07703216ec1bf2a04fa477328705f4c4ce6affb93e18b61d039fa455b67c575a453f9a203383fefb97b84b64d31d29260ecdc464e50d0c92

  • SSDEEP

    6144:CBGieZs2356GuKrJJtMIzPwP54DzXDCCRKyUT5:xi6s2klKW4PImzXDNRPy5

Score
10/10
persistence

Malware Config

Targets

    • Target

      599c80032f4a73b265d4204937e3a149b28faec51b90e10a9b5afa659bff05df

    • Size

      277KB

    • MD5

      037a3f857f2e74c51ed44784bc038737

    • SHA1

      92a8b2e0e4d2f94d9fc9737abafadb7f6c9a547b

    • SHA256

      599c80032f4a73b265d4204937e3a149b28faec51b90e10a9b5afa659bff05df

    • SHA512

      4fea7d836b46e2ce07703216ec1bf2a04fa477328705f4c4ce6affb93e18b61d039fa455b67c575a453f9a203383fefb97b84b64d31d29260ecdc464e50d0c92

    • SSDEEP

      6144:CBGieZs2356GuKrJJtMIzPwP54DzXDCCRKyUT5:xi6s2klKW4PImzXDNRPy5

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks