Overview

overview

8

Static

static

e28caf89ff...4b.exe

windows7-x64

8

e28caf89ff...4b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e28caf89ff2f2d6579f7e49bf4e69bb2b07e3d0a0c8ae39f875c3d309b915e4b

  • Size

    222KB

  • Sample

    221123-p4cd3aga3s

  • MD5

    c787afed386c51d58fc01c9931d806ec

  • SHA1

    626472a865ff8c01235bc4ac9f810857dea39811

  • SHA256

    e28caf89ff2f2d6579f7e49bf4e69bb2b07e3d0a0c8ae39f875c3d309b915e4b

  • SHA512

    2693186f08825427e9ecbfc8cb36c255b23e714b1a44d86e7428d5377a8ddbeaeedb81b16ae2196952846b1f88e6f1b98cd769ba23737edd0f24fbe000c597ac

  • SSDEEP

    3072:ByznQkl1GQxdvoBy8oPCvDh+0OyneN3AIdj5W9lrgYumqi/mPPwaBbb:G1lf8oPCvDI0i3AIdj5G8YuxPP1

Score
8/10
persistence

Malware Config

Targets

    • Target

      e28caf89ff2f2d6579f7e49bf4e69bb2b07e3d0a0c8ae39f875c3d309b915e4b

    • Size

      222KB

    • MD5

      c787afed386c51d58fc01c9931d806ec

    • SHA1

      626472a865ff8c01235bc4ac9f810857dea39811

    • SHA256

      e28caf89ff2f2d6579f7e49bf4e69bb2b07e3d0a0c8ae39f875c3d309b915e4b

    • SHA512

      2693186f08825427e9ecbfc8cb36c255b23e714b1a44d86e7428d5377a8ddbeaeedb81b16ae2196952846b1f88e6f1b98cd769ba23737edd0f24fbe000c597ac

    • SSDEEP

      3072:ByznQkl1GQxdvoBy8oPCvDh+0OyneN3AIdj5W9lrgYumqi/mPPwaBbb:G1lf8oPCvDI0i3AIdj5G8YuxPP1

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks