Overview

overview

8

Static

static

22263fcaf8...6e.exe

windows7-x64

8

22263fcaf8...6e.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22263fcaf8f353da2f9c444047f5571fa86a0d01b492ebff0a9958d3d82e936e

  • Size

    158KB

  • Sample

    221127-t2e5dsbh35

  • MD5

    0f5787843f85e57c234f9a8eea3b5d17

  • SHA1

    05d9981fd75129980ac61d67ef9f94c62d001f48

  • SHA256

    22263fcaf8f353da2f9c444047f5571fa86a0d01b492ebff0a9958d3d82e936e

  • SHA512

    127fc1cbfe82e6d56971eab0b8c9bccfe7558849eb1e58b9c0e52e371d4ef20ce51b303ba968bdb750dc4e8a36cc1f4e6f7bfe601f58a785f2f139b6f71c7040

  • SSDEEP

    3072:zLXk0tzeGD5/plkS1KXkqYqw3/NaSMuNbZdd0CLYA/qvbROp/:00tz3DSaKOqs13M+ZdtLYA6i

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      22263fcaf8f353da2f9c444047f5571fa86a0d01b492ebff0a9958d3d82e936e

    • Size

      158KB

    • MD5

      0f5787843f85e57c234f9a8eea3b5d17

    • SHA1

      05d9981fd75129980ac61d67ef9f94c62d001f48

    • SHA256

      22263fcaf8f353da2f9c444047f5571fa86a0d01b492ebff0a9958d3d82e936e

    • SHA512

      127fc1cbfe82e6d56971eab0b8c9bccfe7558849eb1e58b9c0e52e371d4ef20ce51b303ba968bdb750dc4e8a36cc1f4e6f7bfe601f58a785f2f139b6f71c7040

    • SSDEEP

      3072:zLXk0tzeGD5/plkS1KXkqYqw3/NaSMuNbZdd0CLYA/qvbROp/:00tz3DSaKOqs13M+ZdtLYA6i

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks