Overview

overview

10

Static

static

cd41dab255...1a.exe

windows7-x64

10

cd41dab255...1a.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd41dab255b50090ce9fef72d6b1c4226c3bf885527c326eba8b90e491ae801a

  • Size

    207KB

  • Sample

    221123-1xf98agd42

  • MD5

    538e6dbfe6c5cb1e8e98c2e8e553a0c6

  • SHA1

    bfe346ca0074aae3fb9fb6d2fb721ec1193e3d4a

  • SHA256

    cd41dab255b50090ce9fef72d6b1c4226c3bf885527c326eba8b90e491ae801a

  • SHA512

    770c0aa6b12e5027772e8c7ff3a0aec45a36b8b4c2cc24835190559e860cf43c13a17264733a667f411ca8f0650af0ff7b4e62491a0a88691db7d96314b16161

  • SSDEEP

    3072:5pTgs2gF1r+W6Ei5RaXRwFd6NnS2jbxWGqt:5pTbDFt+W6VLabNnSbGq

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      cd41dab255b50090ce9fef72d6b1c4226c3bf885527c326eba8b90e491ae801a

    • Size

      207KB

    • MD5

      538e6dbfe6c5cb1e8e98c2e8e553a0c6

    • SHA1

      bfe346ca0074aae3fb9fb6d2fb721ec1193e3d4a

    • SHA256

      cd41dab255b50090ce9fef72d6b1c4226c3bf885527c326eba8b90e491ae801a

    • SHA512

      770c0aa6b12e5027772e8c7ff3a0aec45a36b8b4c2cc24835190559e860cf43c13a17264733a667f411ca8f0650af0ff7b4e62491a0a88691db7d96314b16161

    • SSDEEP

      3072:5pTgs2gF1r+W6Ei5RaXRwFd6NnS2jbxWGqt:5pTbDFt+W6VLabNnSbGq

    Score
    10/10
    evasionpersistence

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks