Overview

overview

8

Static

static

a766b8fee9...50.exe

windows7-x64

8

a766b8fee9...50.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050

  • Size

    286KB

  • Sample

    221125-h473eaae53

  • MD5

    0dc2f8d7a662bac9d1e0da123609aba0

  • SHA1

    bc334490f0f1c22f9a3accdae35b9345e71b4d69

  • SHA256

    a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050

  • SHA512

    b802d059feb2b5c051f13ad11312c314138d43b64b6384cb9ec352e34b359f9fe56beb0f574e0329a8ac1751d2a7f6c638365e6914b5f740117f010beb5ccd9c

  • SSDEEP

    6144:/OJGUDbfd/6+D1Hon0PB2eYlLXiygmpEeIwJ9/3H64oO5Q:iGmJ/6yTPB2tXiBmpEeIwJpX6SQ

Score
8/10
persistence

Malware Config

Targets

    • Target

      a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050

    • Size

      286KB

    • MD5

      0dc2f8d7a662bac9d1e0da123609aba0

    • SHA1

      bc334490f0f1c22f9a3accdae35b9345e71b4d69

    • SHA256

      a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050

    • SHA512

      b802d059feb2b5c051f13ad11312c314138d43b64b6384cb9ec352e34b359f9fe56beb0f574e0329a8ac1751d2a7f6c638365e6914b5f740117f010beb5ccd9c

    • SSDEEP

      6144:/OJGUDbfd/6+D1Hon0PB2eYlLXiygmpEeIwJ9/3H64oO5Q:iGmJ/6yTPB2tXiBmpEeIwJpX6SQ

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks