General
-
Target
d69ce086dea6c4c420a6f1f109ea9cec7d41f8179eaa36234c3ae2df59b97d82
-
Size
4.0MB
-
Sample
221006-c63b2sgdbr
-
MD5
4946fad6a7cc59b7fe1bd13d3d1f6317
-
SHA1
a5ed7f1db7697945d3f00a894061d702e4b3da34
-
SHA256
d69ce086dea6c4c420a6f1f109ea9cec7d41f8179eaa36234c3ae2df59b97d82
-
SHA512
31faeeef6c6545ac5858f2b0d6160dd93be3b5b650ed9dfe69f65d0b970eca0c8a873fd1c7ac4bb952570b340bde45ede21dc7a5437a6a5a696a92a129ecd065
-
SSDEEP
49152:jV9/NaRDZWpiVqg2nY9d4+g54EJoC05rLKhBsJsAbCora3+Vk9sClHo4DsRuNifY:5drgu6m+gJq5rL4sJsAbR87sC1o4o240
Static task
static1
Malware Config
Targets
-
-
Target
d69ce086dea6c4c420a6f1f109ea9cec7d41f8179eaa36234c3ae2df59b97d82
-
Size
4.0MB
-
MD5
4946fad6a7cc59b7fe1bd13d3d1f6317
-
SHA1
a5ed7f1db7697945d3f00a894061d702e4b3da34
-
SHA256
d69ce086dea6c4c420a6f1f109ea9cec7d41f8179eaa36234c3ae2df59b97d82
-
SHA512
31faeeef6c6545ac5858f2b0d6160dd93be3b5b650ed9dfe69f65d0b970eca0c8a873fd1c7ac4bb952570b340bde45ede21dc7a5437a6a5a696a92a129ecd065
-
SSDEEP
49152:jV9/NaRDZWpiVqg2nY9d4+g54EJoC05rLKhBsJsAbCora3+Vk9sClHo4DsRuNifY:5drgu6m+gJq5rL4sJsAbR87sC1o4o240
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-