Overview

overview

10

Static

static

dfea0b49c1...e1.exe

windows7-x64

10

dfea0b49c1...e1.exe

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    dfea0b49c1cfa9fbd0aa168fe740a70d6eab0c40e544e9b105ce8fb3eed795e1

  • Size

    206KB

  • Sample

    221003-cj3pasbfh4

  • MD5

    024f08de698b6b7e784214f4fcaa05a4

  • SHA1

    e2ba2fc3ef2b8b97a7ed500633cda58fdd652a93

  • SHA256

    dfea0b49c1cfa9fbd0aa168fe740a70d6eab0c40e544e9b105ce8fb3eed795e1

  • SHA512

    b94e940653076d29c780c2ecb4f4910737404f9f8861b14b254f06069616962f12c7976bcc8bc30f7a04596432988c6db2ac949011e7d92414e2e7672b2c3084

  • SSDEEP

    3072:7YbzUjda2IUFtqEqWDPuA3JXYIBLgU+XCOjBS/9sCQqp6FV2M/MJ4Lo8HecmbCwO:8bQ5Z1tbDPbaQLyl0uPqp6iM/8Oy131

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      dfea0b49c1cfa9fbd0aa168fe740a70d6eab0c40e544e9b105ce8fb3eed795e1

    • Size

      206KB

    • MD5

      024f08de698b6b7e784214f4fcaa05a4

    • SHA1

      e2ba2fc3ef2b8b97a7ed500633cda58fdd652a93

    • SHA256

      dfea0b49c1cfa9fbd0aa168fe740a70d6eab0c40e544e9b105ce8fb3eed795e1

    • SHA512

      b94e940653076d29c780c2ecb4f4910737404f9f8861b14b254f06069616962f12c7976bcc8bc30f7a04596432988c6db2ac949011e7d92414e2e7672b2c3084

    • SSDEEP

      3072:7YbzUjda2IUFtqEqWDPuA3JXYIBLgU+XCOjBS/9sCQqp6FV2M/MJ4Lo8HecmbCwO:8bQ5Z1tbDPbaQLyl0uPqp6iM/8Oy131

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks