Overview

overview

8

Static

static

301419811a...da.exe

windows7-x64

8

301419811a...da.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    301419811ac9bfb99c27364468fec30425cc439ec989af7b8a3a00e90b0b83da

  • Size

    156KB

  • Sample

    221123-sw8zvacd68

  • MD5

    823c37dcbc53967e1649e7e47167a965

  • SHA1

    89449923971dcf1970adbb1719d3b1ceb428c2a8

  • SHA256

    301419811ac9bfb99c27364468fec30425cc439ec989af7b8a3a00e90b0b83da

  • SHA512

    dbf156e3f2a6b2115a99538ceeb5781f54d85b5b1d4243e06e3fef645ea3577aeb778b45d2c359973744a3713285f15f364e11edcaaf0e3d2644cccecc52f7d6

  • SSDEEP

    3072:PMngP1zP4IKrGpnqIE2Vc4cffB8Pzn0sZTz5btNE:kEwGpLcvnMDJTzJE

Score
8/10
persistence

Malware Config

Targets

    • Target

      301419811ac9bfb99c27364468fec30425cc439ec989af7b8a3a00e90b0b83da

    • Size

      156KB

    • MD5

      823c37dcbc53967e1649e7e47167a965

    • SHA1

      89449923971dcf1970adbb1719d3b1ceb428c2a8

    • SHA256

      301419811ac9bfb99c27364468fec30425cc439ec989af7b8a3a00e90b0b83da

    • SHA512

      dbf156e3f2a6b2115a99538ceeb5781f54d85b5b1d4243e06e3fef645ea3577aeb778b45d2c359973744a3713285f15f364e11edcaaf0e3d2644cccecc52f7d6

    • SSDEEP

      3072:PMngP1zP4IKrGpnqIE2Vc4cffB8Pzn0sZTz5btNE:kEwGpLcvnMDJTzJE

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks