ded9768d750977551b734180e6660d7f97d0bdb6312657379582762fb9f6bd02 | Triage

Sharing

General

Target

ded9768d750977551b734180e6660d7f97d0bdb6312657379582762fb9f6bd02
Size

223KB
Sample

221124-wrqt9aba87
MD5

89ee14630b6ae6ec01b360a61b25896e
SHA1

eadaed8be02f533c02cbb248f71cbe406b239ccc
SHA256

ded9768d750977551b734180e6660d7f97d0bdb6312657379582762fb9f6bd02
SHA512

6f0d6055e17f2a00e1000b9ef137ba7d6f44218783bce4f746e9fad1b67967af4f02e46579b32985bc2eff6ed255c126257606fd2c1a9744fc3e658e52e1494f
SSDEEP

3072:zg0Q0GbixEiMPK7oGnamAMV9PH7mHRXPwvCxqRKmU744aXoU+bpeQmAzTQbxtF7f:kPfkXNaiV9v7mcRKmUs4+ow4z0tB

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ded9768d750977551b734180e6660d7f97d0bdb6312657379582762fb9f6bd02
- Size
  
  223KB
- MD5
  
  89ee14630b6ae6ec01b360a61b25896e
- SHA1
  
  eadaed8be02f533c02cbb248f71cbe406b239ccc
- SHA256
  
  ded9768d750977551b734180e6660d7f97d0bdb6312657379582762fb9f6bd02
- SHA512
  
  6f0d6055e17f2a00e1000b9ef137ba7d6f44218783bce4f746e9fad1b67967af4f02e46579b32985bc2eff6ed255c126257606fd2c1a9744fc3e658e52e1494f
- SSDEEP
  
  3072:zg0Q0GbixEiMPK7oGnamAMV9PH7mHRXPwvCxqRKmU744aXoU+bpeQmAzTQbxtF7f:kPfkXNaiV9v7mcRKmUs4+ow4z0tB
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2