Overview

overview

10

Static

static

5

b4de403ac4...de.exe

windows7-x64

10

b4de403ac4...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4de403ac4ea353768eac0f8341508383cdcd6a6fc11f48ec9503a21726845de

  • Size

    778KB

  • Sample

    221028-15aseahdf7

  • MD5

    0ce7da27c1c757bcafec6ccfc06d95a0

  • SHA1

    ceb6d9839533a91098e20dec49f8774925babe5c

  • SHA256

    b4de403ac4ea353768eac0f8341508383cdcd6a6fc11f48ec9503a21726845de

  • SHA512

    8cb4b31a78c3dee520b202c770facf291544faf55b90eb4be4a1a68e2eeddc1d404c4b7a87008f474572b02da602b181e3006c05b274e5f88944b5236ba651e1

  • SSDEEP

    12288:+hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aAUuVHmNXDSqV3SxBiAszV:ORmJkcoQricOIQxiZY1iaRFNOqZ4BirV

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      b4de403ac4ea353768eac0f8341508383cdcd6a6fc11f48ec9503a21726845de

    • Size

      778KB

    • MD5

      0ce7da27c1c757bcafec6ccfc06d95a0

    • SHA1

      ceb6d9839533a91098e20dec49f8774925babe5c

    • SHA256

      b4de403ac4ea353768eac0f8341508383cdcd6a6fc11f48ec9503a21726845de

    • SHA512

      8cb4b31a78c3dee520b202c770facf291544faf55b90eb4be4a1a68e2eeddc1d404c4b7a87008f474572b02da602b181e3006c05b274e5f88944b5236ba651e1

    • SSDEEP

      12288:+hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aAUuVHmNXDSqV3SxBiAszV:ORmJkcoQricOIQxiZY1iaRFNOqZ4BirV

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks