c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7 | Triage

Sharing

General

Target

c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7
Size

480KB
Sample

221124-yasnmahd51
MD5

72ee7d175b2a9b4748bb1f332ae8b407
SHA1

e477094547dccaf6bab7b6edbff680acb2cd7203
SHA256

c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7
SHA512

dce008173b88f7dd090d2f09e4007fe0345b56740dd333f627fb8612ebc7f0476306fa73136410d6623ca177e6922951b0b0bf60f6ebdb43549359e676d788cf
SSDEEP

12288:GKVzzv6+WPUQ0gP2xhahj+P4qGuUuUDlzdMMMMMMMMMMMMMMMMMMTB:4+WPTnemoP4qGvu6zdMMMMMMMMMMMMMw

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7
- Size
  
  480KB
- MD5
  
  72ee7d175b2a9b4748bb1f332ae8b407
- SHA1
  
  e477094547dccaf6bab7b6edbff680acb2cd7203
- SHA256
  
  c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7
- SHA512
  
  dce008173b88f7dd090d2f09e4007fe0345b56740dd333f627fb8612ebc7f0476306fa73136410d6623ca177e6922951b0b0bf60f6ebdb43549359e676d788cf
- SSDEEP
  
  12288:GKVzzv6+WPUQ0gP2xhahj+P4qGuUuUDlzdMMMMMMMMMMMMMMMMMMTB:4+WPTnemoP4qGvu6zdMMMMMMMMMMMMMw
Score

8^/10

persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2