Overview

overview

9

Static

static

b645cd41f6...fc.exe

windows7-x64

9

b645cd41f6...fc.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b645cd41f66631ca788b53865205184bed2ceef5e959b4f5cd2953234e8ec3fc

  • Size

    589KB

  • Sample

    221123-xbjaxaee33

  • MD5

    b459c324e677046f80e97b4d7cd6f84d

  • SHA1

    7f63fc5c1c3a17b58473a2c5db411530b2516d95

  • SHA256

    b645cd41f66631ca788b53865205184bed2ceef5e959b4f5cd2953234e8ec3fc

  • SHA512

    1f58ccce137fee4d4061db3d74fe3bb7097e6f601851982e2d3bb8743b5f210e027dab59e580608f67194bda1eabe2244ab18de0f24526caf7eb302b2b2560bb

  • SSDEEP

    12288:eJRwKNvcI2MwomfyvwN3aA90kb72qyW1rHD84UlZNK:ZKNvcI2MwomfyvwN3/l7Ry0t8NK

Score
9/10
persistence

Malware Config

Targets

    • Target

      b645cd41f66631ca788b53865205184bed2ceef5e959b4f5cd2953234e8ec3fc

    • Size

      589KB

    • MD5

      b459c324e677046f80e97b4d7cd6f84d

    • SHA1

      7f63fc5c1c3a17b58473a2c5db411530b2516d95

    • SHA256

      b645cd41f66631ca788b53865205184bed2ceef5e959b4f5cd2953234e8ec3fc

    • SHA512

      1f58ccce137fee4d4061db3d74fe3bb7097e6f601851982e2d3bb8743b5f210e027dab59e580608f67194bda1eabe2244ab18de0f24526caf7eb302b2b2560bb

    • SSDEEP

      12288:eJRwKNvcI2MwomfyvwN3aA90kb72qyW1rHD84UlZNK:ZKNvcI2MwomfyvwN3/l7Ry0t8NK

    Score
    9/10
    persistence

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks