Overview

overview

10

Static

static

bb93aa631e...a0.exe

windows7-x64

10

bb93aa631e...a0.exe

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    bb93aa631e1d1b6c926227bdc0dff5777dbebb5a708cd88bd22cb5f824d239a0

  • Size

    126KB

  • Sample

    221107-mxmkcaegbr

  • MD5

    049d0333a668d2764c540db1f965c812

  • SHA1

    7d901803f27a5a0c82e2b43a7b745b9e82ae4f5f

  • SHA256

    bb93aa631e1d1b6c926227bdc0dff5777dbebb5a708cd88bd22cb5f824d239a0

  • SHA512

    cb9b4572d776171bc94b9b260cb5c5817ee4a85fb93652f310d781835832e1b0f4b2ad02cd1518b9df11b46434e5642bb1e434363e19f7a6fac90daa0806c2e9

  • SSDEEP

    3072:8TrOGE4+8V3ENTRs0wRnaEQOd7687QlGA5c3/hp:8FE4iTRs0w8EQOU6Uk35

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      bb93aa631e1d1b6c926227bdc0dff5777dbebb5a708cd88bd22cb5f824d239a0

    • Size

      126KB

    • MD5

      049d0333a668d2764c540db1f965c812

    • SHA1

      7d901803f27a5a0c82e2b43a7b745b9e82ae4f5f

    • SHA256

      bb93aa631e1d1b6c926227bdc0dff5777dbebb5a708cd88bd22cb5f824d239a0

    • SHA512

      cb9b4572d776171bc94b9b260cb5c5817ee4a85fb93652f310d781835832e1b0f4b2ad02cd1518b9df11b46434e5642bb1e434363e19f7a6fac90daa0806c2e9

    • SSDEEP

      3072:8TrOGE4+8V3ENTRs0wRnaEQOd7687QlGA5c3/hp:8FE4iTRs0w8EQOU6Uk35

    Score
    10/10
    evasionpersistence

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks