Overview

overview

10

Static

static

c50c6add28...6d.exe

windows7-x64

10

c50c6add28...6d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c50c6add28bdda1fc07e33a3bd97c885f0709410e6f4512b70bb149c00829f6d

  • Size

    508KB

  • Sample

    221123-z56dmsee75

  • MD5

    44dba3fb55b165d5049b3685dd85cd89

  • SHA1

    99beea819a71f2c68e8a73ded9820dd44f5a71f1

  • SHA256

    c50c6add28bdda1fc07e33a3bd97c885f0709410e6f4512b70bb149c00829f6d

  • SHA512

    cd070e8cc13487317df6c10e69baeebf135a9dd18fd9a3977020833bde4390229547e0dc19d44bdaa9f88a2fe5eabde493e30db98e39fd54202498e65ab0374c

  • SSDEEP

    6144:X3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:X3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      c50c6add28bdda1fc07e33a3bd97c885f0709410e6f4512b70bb149c00829f6d

    • Size

      508KB

    • MD5

      44dba3fb55b165d5049b3685dd85cd89

    • SHA1

      99beea819a71f2c68e8a73ded9820dd44f5a71f1

    • SHA256

      c50c6add28bdda1fc07e33a3bd97c885f0709410e6f4512b70bb149c00829f6d

    • SHA512

      cd070e8cc13487317df6c10e69baeebf135a9dd18fd9a3977020833bde4390229547e0dc19d44bdaa9f88a2fe5eabde493e30db98e39fd54202498e65ab0374c

    • SSDEEP

      6144:X3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:X3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks