Overview

overview

8

Static

static

4c589ecc28...05.exe

windows7-x64

8

4c589ecc28...05.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    4c589ecc28b26c6ae0a672b03afceb20148c0db16b6bb792561b938e545eb905

  • Size

    172KB

  • Sample

    221019-2xnvqscad3

  • MD5

    a0f98d66bc9a227e3bc59d93582061ee

  • SHA1

    f427815bacfda545816b6f25218b2aa3b09464e5

  • SHA256

    4c589ecc28b26c6ae0a672b03afceb20148c0db16b6bb792561b938e545eb905

  • SHA512

    b845e40db35ccd15595fc2003be104eeac0315b7b74ce82dbd5c61169ae2799edd1437a707f82037a1e925059fc6b840e0464fb4fd82bf624d3afae3c6b76c97

  • SSDEEP

    3072:DLnkbiDMbCst4QW9Gr0duDi2nJSmAGsF7tmSSZEnS5FXiq9QMouHY2xE:DrwiiC9GIdui2JSF7ozWnSCqfoWY

Score
8/10
persistence

Malware Config

Targets

    • Target

      4c589ecc28b26c6ae0a672b03afceb20148c0db16b6bb792561b938e545eb905

    • Size

      172KB

    • MD5

      a0f98d66bc9a227e3bc59d93582061ee

    • SHA1

      f427815bacfda545816b6f25218b2aa3b09464e5

    • SHA256

      4c589ecc28b26c6ae0a672b03afceb20148c0db16b6bb792561b938e545eb905

    • SHA512

      b845e40db35ccd15595fc2003be104eeac0315b7b74ce82dbd5c61169ae2799edd1437a707f82037a1e925059fc6b840e0464fb4fd82bf624d3afae3c6b76c97

    • SSDEEP

      3072:DLnkbiDMbCst4QW9Gr0duDi2nJSmAGsF7tmSSZEnS5FXiq9QMouHY2xE:DrwiiC9GIdui2JSF7ozWnSCqfoWY

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks