General

  • Target

    2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722

  • Size

    482KB

  • Sample

    221026-2d4rvahedr

  • MD5

    110c9be4c49682a8b685fe9d1f73ab5c

  • SHA1

    fdd1828aea33d5cd114646e4e462ad0996502a18

  • SHA256

    2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722

  • SHA512

    9e20dc0d167075490c7e45a39e70854c96af962b0e5a7cddf6e0454cc3fc48198a9094715da8db91ffe6ad422181ed90426debff9c2bf469f9f76153243f243c

  • SSDEEP

    6144:QegXa09mzcQQxXROmhbUOdWoSNYZEpCdIryEAjyFcUNcNB9ck5kSKIHJcO6CyJxY:QNQcROgbjWoSNTpCdIryErFVih5q4ezc

Malware Config

Targets

    • Target

      2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722

    • Size

      482KB

    • MD5

      110c9be4c49682a8b685fe9d1f73ab5c

    • SHA1

      fdd1828aea33d5cd114646e4e462ad0996502a18

    • SHA256

      2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722

    • SHA512

      9e20dc0d167075490c7e45a39e70854c96af962b0e5a7cddf6e0454cc3fc48198a9094715da8db91ffe6ad422181ed90426debff9c2bf469f9f76153243f243c

    • SSDEEP

      6144:QegXa09mzcQQxXROmhbUOdWoSNYZEpCdIryEAjyFcUNcNB9ck5kSKIHJcO6CyJxY:QNQcROgbjWoSNTpCdIryErFVih5q4ezc

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • UAC bypass

    • Windows security bypass

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops startup file

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks