Overview

overview

10

Static

static

2f3612e848...b6.exe

windows7-x64

10

2f3612e848...b6.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f3612e8483adc626cef799bd6b9cb2b3489be5563384c2c2f8bf086d99cf5b6

  • Size

    162KB

  • Sample

    221123-r2cyxsda81

  • MD5

    69f263dce3eaafef1208d56af7f291f9

  • SHA1

    f75b33d4f9e292902ee7c25c3744b8b41f6d6774

  • SHA256

    2f3612e8483adc626cef799bd6b9cb2b3489be5563384c2c2f8bf086d99cf5b6

  • SHA512

    f4654b0d6dfc0fbbcc8b800f1b88b33025795bf325363a61b88b4968aa8588c824e8fad96d7d489821cec262d01c02111d9e256c53b213837d463c03b03b3f9c

  • SSDEEP

    3072:yEPmkkA8rAWJvXvxO2pbRNXu3u+RRn+ppXW1CJXJxJUe28jLlVPth83H1mjz1kH:tujAWxvxnPNqjRR+zW18JUaLzbgVR

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      2f3612e8483adc626cef799bd6b9cb2b3489be5563384c2c2f8bf086d99cf5b6

    • Size

      162KB

    • MD5

      69f263dce3eaafef1208d56af7f291f9

    • SHA1

      f75b33d4f9e292902ee7c25c3744b8b41f6d6774

    • SHA256

      2f3612e8483adc626cef799bd6b9cb2b3489be5563384c2c2f8bf086d99cf5b6

    • SHA512

      f4654b0d6dfc0fbbcc8b800f1b88b33025795bf325363a61b88b4968aa8588c824e8fad96d7d489821cec262d01c02111d9e256c53b213837d463c03b03b3f9c

    • SSDEEP

      3072:yEPmkkA8rAWJvXvxO2pbRNXu3u+RRn+ppXW1CJXJxJUe28jLlVPth83H1mjz1kH:tujAWxvxnPNqjRR+zW18JUaLzbgVR

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks