e16cde1e575a269abf2f01a619b83a7742cc8dcb04492cb29ccf9ddcd47e5537 | Triage

Sharing

General

Target

e16cde1e575a269abf2f01a619b83a7742cc8dcb04492cb29ccf9ddcd47e5537
Size

127KB
Sample

221019-1bet9shdbq
MD5

a154cb40008a143c542d7fe55f946bd0
SHA1

2fc30a0d51396ec2f44c5b7dae7370b5784c9649
SHA256

e16cde1e575a269abf2f01a619b83a7742cc8dcb04492cb29ccf9ddcd47e5537
SHA512

41c2b59204cb861d8456acc1eeff72f767a40778d8db176012abd24b81e94be89f112835050da3b7fa6b0d9c57ad08e7811d963c69c0f19c3e47140f396c943d
SSDEEP

3072:F4MDa3UGy+aMLaL7gvtVk4r404a8B/zQYSMN:xDaERjMOaUK898q

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e16cde1e575a269abf2f01a619b83a7742cc8dcb04492cb29ccf9ddcd47e5537
- Size
  
  127KB
- MD5
  
  a154cb40008a143c542d7fe55f946bd0
- SHA1
  
  2fc30a0d51396ec2f44c5b7dae7370b5784c9649
- SHA256
  
  e16cde1e575a269abf2f01a619b83a7742cc8dcb04492cb29ccf9ddcd47e5537
- SHA512
  
  41c2b59204cb861d8456acc1eeff72f767a40778d8db176012abd24b81e94be89f112835050da3b7fa6b0d9c57ad08e7811d963c69c0f19c3e47140f396c943d
- SSDEEP
  
  3072:F4MDa3UGy+aMLaL7gvtVk4r404a8B/zQYSMN:xDaERjMOaUK898q
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2