Overview

overview

8

Static

static

394d0e5731...1d.exe

windows7-x64

8

394d0e5731...1d.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    394d0e57318e0dcd9e004d93bc1ebed60699955098d9716280fa548fbdaf631d

  • Size

    330KB

  • Sample

    221124-e29lnshb43

  • MD5

    c46ee9508f1a2bba97ed9a89d9b03415

  • SHA1

    ff59eb4a2f76aac11f2d76dfe800c3010596382a

  • SHA256

    394d0e57318e0dcd9e004d93bc1ebed60699955098d9716280fa548fbdaf631d

  • SHA512

    100530657346196d3981c0d3349c4046b251520a5997acaeb55be82c966277056155cf7e4cbccc5c28c63210c9c55648fd915f197c7ce637da2963993f324967

  • SSDEEP

    6144:otE97FUgViyUXe2ZsD9eBVtQRlc12iVkIFzS9TLSDoC3FHvKHMJnAw:oaNFPiym920jcc1f9G9XS335vHr

Score
8/10
persistence

Malware Config

Targets

    • Target

      394d0e57318e0dcd9e004d93bc1ebed60699955098d9716280fa548fbdaf631d

    • Size

      330KB

    • MD5

      c46ee9508f1a2bba97ed9a89d9b03415

    • SHA1

      ff59eb4a2f76aac11f2d76dfe800c3010596382a

    • SHA256

      394d0e57318e0dcd9e004d93bc1ebed60699955098d9716280fa548fbdaf631d

    • SHA512

      100530657346196d3981c0d3349c4046b251520a5997acaeb55be82c966277056155cf7e4cbccc5c28c63210c9c55648fd915f197c7ce637da2963993f324967

    • SSDEEP

      6144:otE97FUgViyUXe2ZsD9eBVtQRlc12iVkIFzS9TLSDoC3FHvKHMJnAw:oaNFPiym920jcc1f9G9XS335vHr

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks