Overview

overview

8

Static

static

7b2cb5bf97...ba.exe

windows7-x64

8

7b2cb5bf97...ba.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b2cb5bf97c92621d4b15b64f242a9bf1cc6d899ad96c74601a4a8aaf9704aba

  • Size

    169KB

  • Sample

    221126-233abafc8t

  • MD5

    09a49e043c9df84812e74d4b001eeccf

  • SHA1

    684fc6689e9182e042c6231758f588b8de8d5fe2

  • SHA256

    7b2cb5bf97c92621d4b15b64f242a9bf1cc6d899ad96c74601a4a8aaf9704aba

  • SHA512

    230d68547c34fff4397b4d93500dfdc73c0d662cf64e8524dcacff4c3e6bc1f76a974db2ce10d07e98fb061fecfcd8d188167003ffbfb91de180208953a2c437

  • SSDEEP

    3072:xKXR/jtaBLpvKPwxK3bEguprek32x+cBy3rtCzmnbEwW80/PqsOpC2XPBz5u:xKBBMLpU33uZek32x++UrtAmnbnZHHBM

Score
8/10
persistence

Malware Config

Targets

    • Target

      7b2cb5bf97c92621d4b15b64f242a9bf1cc6d899ad96c74601a4a8aaf9704aba

    • Size

      169KB

    • MD5

      09a49e043c9df84812e74d4b001eeccf

    • SHA1

      684fc6689e9182e042c6231758f588b8de8d5fe2

    • SHA256

      7b2cb5bf97c92621d4b15b64f242a9bf1cc6d899ad96c74601a4a8aaf9704aba

    • SHA512

      230d68547c34fff4397b4d93500dfdc73c0d662cf64e8524dcacff4c3e6bc1f76a974db2ce10d07e98fb061fecfcd8d188167003ffbfb91de180208953a2c437

    • SSDEEP

      3072:xKXR/jtaBLpvKPwxK3bEguprek32x+cBy3rtCzmnbEwW80/PqsOpC2XPBz5u:xKBBMLpU33uZek32x++UrtAmnbnZHHBM

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks