General

  • Target

    e9716f6d6628b5e4568a61b24d3eef16a45523d1a296fb40d6f970839a1e0310

  • Size

    208KB

  • Sample

    221003-s9nwtsdee6

  • MD5

    6375ca033aa08603e60739635fefd100

  • SHA1

    0b7a32bd7115953fb64977b0609a9a128f40822b

  • SHA256

    e9716f6d6628b5e4568a61b24d3eef16a45523d1a296fb40d6f970839a1e0310

  • SHA512

    4e8b02588a6bb86cdacde655608c7142d9d641b703f420ac356b87e91edaa20509e5347974fc67fb3bb22af489b13cb1e9e7397d6977ac12f5580e3d33f380d2

  • SSDEEP

    768:XB366OCWj9EIjN0/Hmxn9VvO/X2VLfLbnIkSL7DzViCJQyTVnqn85b98ueeYo89s:grdMUS3vJQyTQT01dmUQHl91RGz4K7D

Malware Config

Targets

    • Target

      e9716f6d6628b5e4568a61b24d3eef16a45523d1a296fb40d6f970839a1e0310

    • Size

      208KB

    • MD5

      6375ca033aa08603e60739635fefd100

    • SHA1

      0b7a32bd7115953fb64977b0609a9a128f40822b

    • SHA256

      e9716f6d6628b5e4568a61b24d3eef16a45523d1a296fb40d6f970839a1e0310

    • SHA512

      4e8b02588a6bb86cdacde655608c7142d9d641b703f420ac356b87e91edaa20509e5347974fc67fb3bb22af489b13cb1e9e7397d6977ac12f5580e3d33f380d2

    • SSDEEP

      768:XB366OCWj9EIjN0/Hmxn9VvO/X2VLfLbnIkSL7DzViCJQyTVnqn85b98ueeYo89s:grdMUS3vJQyTQT01dmUQHl91RGz4K7D

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Tasks