Overview

overview

8

Static

static

449b8cff9a...8f.exe

windows7-x64

8

449b8cff9a...8f.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    449b8cff9a08de5c226e4f2b308edd8256f538122a4f9161c56302473e1ade8f

  • Size

    91KB

  • Sample

    221127-tnmmbaed5y

  • MD5

    8d409b3240108ec5065a4174cce24238

  • SHA1

    cabc35398148efd7e3c54e3692c4f885eb05788d

  • SHA256

    449b8cff9a08de5c226e4f2b308edd8256f538122a4f9161c56302473e1ade8f

  • SHA512

    7f4211456e211d3d12c14ec8f7e02f926461c4a284fd60d2a6527fa2abcfb919c86467a016c32b12209afe05b3ada4da0eab9202dafc123ee7e449f7300ffa85

  • SSDEEP

    1536:MedyT/EDGm9S74sJAg8GDbq9TGRtIKCt7YhiTVPfr89/4NBRky/:hKE7xseg3eMtI7QiTVr89/uk2

Score
8/10
persistence

Malware Config

Targets

    • Target

      449b8cff9a08de5c226e4f2b308edd8256f538122a4f9161c56302473e1ade8f

    • Size

      91KB

    • MD5

      8d409b3240108ec5065a4174cce24238

    • SHA1

      cabc35398148efd7e3c54e3692c4f885eb05788d

    • SHA256

      449b8cff9a08de5c226e4f2b308edd8256f538122a4f9161c56302473e1ade8f

    • SHA512

      7f4211456e211d3d12c14ec8f7e02f926461c4a284fd60d2a6527fa2abcfb919c86467a016c32b12209afe05b3ada4da0eab9202dafc123ee7e449f7300ffa85

    • SSDEEP

      1536:MedyT/EDGm9S74sJAg8GDbq9TGRtIKCt7YhiTVPfr89/4NBRky/:hKE7xseg3eMtI7QiTVr89/uk2

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks