Overview

overview

8

Static

static

dcdb8476cc...bf.exe

windows7-x64

8

dcdb8476cc...bf.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    dcdb8476cc87c41643967f7840df73e6043abd0cbf875036c11d04a4c7b6debf

  • Size

    217KB

  • Sample

    221011-v5wf8affh4

  • MD5

    140e7b645d437870e52d21af116bac5a

  • SHA1

    ec185ca5c1000a48672291822d431a97c058c35e

  • SHA256

    dcdb8476cc87c41643967f7840df73e6043abd0cbf875036c11d04a4c7b6debf

  • SHA512

    d706d569aa0065cb30365060082ca1322d4fe51521f679e34666807ede945a275ea87fc2b0b094bd25a02931f855a43a69a75d252f902ce892574a772e66caf9

  • SSDEEP

    3072:CeyJ3GRRmPq3+mQwKm4xw+v/DnyS0hopj59yyelFCf0YHGO2e4PvzMnX:CeQGmSudtlZqW9YCf0YHkeIvm

Score
8/10
persistence

Malware Config

Targets

    • Target

      dcdb8476cc87c41643967f7840df73e6043abd0cbf875036c11d04a4c7b6debf

    • Size

      217KB

    • MD5

      140e7b645d437870e52d21af116bac5a

    • SHA1

      ec185ca5c1000a48672291822d431a97c058c35e

    • SHA256

      dcdb8476cc87c41643967f7840df73e6043abd0cbf875036c11d04a4c7b6debf

    • SHA512

      d706d569aa0065cb30365060082ca1322d4fe51521f679e34666807ede945a275ea87fc2b0b094bd25a02931f855a43a69a75d252f902ce892574a772e66caf9

    • SSDEEP

      3072:CeyJ3GRRmPq3+mQwKm4xw+v/DnyS0hopj59yyelFCf0YHGO2e4PvzMnX:CeQGmSudtlZqW9YCf0YHkeIvm

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks