9456b715f919abc7d0f41a8350a77796becb77e07117d9b3473230ace0801497 | Triage

Sharing

General

Target

9456b715f919abc7d0f41a8350a77796becb77e07117d9b3473230ace0801497
Size

220KB
Sample

221029-b2xekafec3
MD5

0001b91028e5793260732cc45e2aa5f0
SHA1

395a735e189dc98e0e968278bc499c95c8e31579
SHA256

9456b715f919abc7d0f41a8350a77796becb77e07117d9b3473230ace0801497
SHA512

d382a3fc5543b9a8c0f138d12d307a7a062317a98cce83f39827a33f11d58173842b05bead451993876ac832cfc7441c3e8845d93e7d53071d1f7801713d92af
SSDEEP

6144:A6FzEWejt9E0pk9wPZMD6bkSJErmhHCf/rneW/i:vZejtOUjZMD6btErmhE/ro

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  9456b715f919abc7d0f41a8350a77796becb77e07117d9b3473230ace0801497
- Size
  
  220KB
- MD5
  
  0001b91028e5793260732cc45e2aa5f0
- SHA1
  
  395a735e189dc98e0e968278bc499c95c8e31579
- SHA256
  
  9456b715f919abc7d0f41a8350a77796becb77e07117d9b3473230ace0801497
- SHA512
  
  d382a3fc5543b9a8c0f138d12d307a7a062317a98cce83f39827a33f11d58173842b05bead451993876ac832cfc7441c3e8845d93e7d53071d1f7801713d92af
- SSDEEP
  
  6144:A6FzEWejt9E0pk9wPZMD6bkSJErmhHCf/rneW/i:vZejtOUjZMD6btErmhE/ro
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2