Overview

overview

10

Static

static

63bb19f8e9...34.exe

windows7-x64

10

63bb19f8e9...34.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63bb19f8e9390aba5fc3d0b08f89d5ee0ba8752ee534bee0862d8a7edcb7f234

  • Size

    53KB

  • Sample

    221029-nmt24seab9

  • MD5

    523353b1f76a793f0feb72e621e0d4a6

  • SHA1

    0c39c8e49b9a3cd627e580ae81eea2dc89e85b06

  • SHA256

    63bb19f8e9390aba5fc3d0b08f89d5ee0ba8752ee534bee0862d8a7edcb7f234

  • SHA512

    ee727530e79356e7393a6ae1f74512c9cd7a0c3e555b4c5d4e26f4f0a87dec6503b95d74289db31742df73f8eac57ae78e41b8e53a50b70101040eced83d976c

  • SSDEEP

    768:x9wGPjwcaF1IaeeTlBHS3L5CH8pWJtNxkG2M93iOldGy1DJ15WJ77gDldqIU73oR:xJkcVqq75ChJ/iVM9SOldGyh7k8TE3y

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      63bb19f8e9390aba5fc3d0b08f89d5ee0ba8752ee534bee0862d8a7edcb7f234

    • Size

      53KB

    • MD5

      523353b1f76a793f0feb72e621e0d4a6

    • SHA1

      0c39c8e49b9a3cd627e580ae81eea2dc89e85b06

    • SHA256

      63bb19f8e9390aba5fc3d0b08f89d5ee0ba8752ee534bee0862d8a7edcb7f234

    • SHA512

      ee727530e79356e7393a6ae1f74512c9cd7a0c3e555b4c5d4e26f4f0a87dec6503b95d74289db31742df73f8eac57ae78e41b8e53a50b70101040eced83d976c

    • SSDEEP

      768:x9wGPjwcaF1IaeeTlBHS3L5CH8pWJtNxkG2M93iOldGy1DJ15WJ77gDldqIU73oR:xJkcVqq75ChJ/iVM9SOldGyh7k8TE3y

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks