9e6a1628222295e94b1d15bbfebc0a22d7cf11d78a5785282283215eab062146 | Triage

Sharing

General

Target

9e6a1628222295e94b1d15bbfebc0a22d7cf11d78a5785282283215eab062146
Size

77KB
Sample

221124-e49dpace2z
MD5

459a1b62476b2b8c246cbebe23ed6035
SHA1

949ace5987007bb1378e2ef7156920269a609943
SHA256

9e6a1628222295e94b1d15bbfebc0a22d7cf11d78a5785282283215eab062146
SHA512

d7ce41e8ad102917844796cf82bf7da03cbc182aacb39373fe1ba47a63f31993e7e9f5ef2d6a4ee74dd62c0cae43a6e0146866bd4839d4ff638b7a8b0d05b7c4
SSDEEP

1536:ZtHF5geAD7efNm9hQH5kCu6W1STnTpGY1hpJ1xzhP9h/nd4:ZxUD7efkNrQTtDphzhPzd4

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  9e6a1628222295e94b1d15bbfebc0a22d7cf11d78a5785282283215eab062146
- Size
  
  77KB
- MD5
  
  459a1b62476b2b8c246cbebe23ed6035
- SHA1
  
  949ace5987007bb1378e2ef7156920269a609943
- SHA256
  
  9e6a1628222295e94b1d15bbfebc0a22d7cf11d78a5785282283215eab062146
- SHA512
  
  d7ce41e8ad102917844796cf82bf7da03cbc182aacb39373fe1ba47a63f31993e7e9f5ef2d6a4ee74dd62c0cae43a6e0146866bd4839d4ff638b7a8b0d05b7c4
- SSDEEP
  
  1536:ZtHF5geAD7efNm9hQH5kCu6W1STnTpGY1hpJ1xzhP9h/nd4:ZxUD7efkNrQTtDphzhPzd4
Score

8^/10

persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2