946e011cc9cd2bd27bfda5a8c8fa185ecd59c7e6bee091f5fc59194a67ef973e | Triage

Sharing

General

Target

946e011cc9cd2bd27bfda5a8c8fa185ecd59c7e6bee091f5fc59194a67ef973e
Size

256KB
Sample

221124-lbh5csdf89
MD5

196f505466314101773bc9f50ad3b2b5
SHA1

97986e2db4d11f4b97c1727c8d3683f6b2dd80ae
SHA256

946e011cc9cd2bd27bfda5a8c8fa185ecd59c7e6bee091f5fc59194a67ef973e
SHA512

9b8dafb2d6d81b88723a6c96ee3abb9cb509dff3aa17490e73b543215cfee92645635e3bd6b53a8eec522b4d9b3539e25e946f90f961b76e4505fd90059465cc
SSDEEP

3072:BDR1MBlhoJNJ1nrunt3CKYQ/Szu32znYIr56+6SpMgvzr9LFE:BQB8JP1nbBzupIrx6KMgfE

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  946e011cc9cd2bd27bfda5a8c8fa185ecd59c7e6bee091f5fc59194a67ef973e
- Size
  
  256KB
- MD5
  
  196f505466314101773bc9f50ad3b2b5
- SHA1
  
  97986e2db4d11f4b97c1727c8d3683f6b2dd80ae
- SHA256
  
  946e011cc9cd2bd27bfda5a8c8fa185ecd59c7e6bee091f5fc59194a67ef973e
- SHA512
  
  9b8dafb2d6d81b88723a6c96ee3abb9cb509dff3aa17490e73b543215cfee92645635e3bd6b53a8eec522b4d9b3539e25e946f90f961b76e4505fd90059465cc
- SSDEEP
  
  3072:BDR1MBlhoJNJ1nrunt3CKYQ/Szu32znYIr56+6SpMgvzr9LFE:BQB8JP1nbBzupIrx6KMgfE
Score

8^/10

persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2