6c08ba3a25f7d1e380aead6863776a05f637d65f0e91a6cf3a857b5c9904b2b8 | Triage

Sharing

General

Target

6c08ba3a25f7d1e380aead6863776a05f637d65f0e91a6cf3a857b5c9904b2b8
Size

229KB
Sample

221127-tze2lsfc2z
MD5

6a748d710298bf827e2394c393caa13e
SHA1

835c020ebb7e20f1255ea539f095aa4be4da9fdd
SHA256

6c08ba3a25f7d1e380aead6863776a05f637d65f0e91a6cf3a857b5c9904b2b8
SHA512

c67b725c870949c0f8b614c083d320af2d8a81f75095bc440dd260286f39085afe4ebec9ef9b08cfa79d3d6337bd4509f7b55e201572ee189496e5764d126ffc
SSDEEP

6144:qxoT72vdWAMNZxOdxey8KODF8IvXgVKpL4n:qqT7EdWAMzQbg8dQ

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  6c08ba3a25f7d1e380aead6863776a05f637d65f0e91a6cf3a857b5c9904b2b8
- Size
  
  229KB
- MD5
  
  6a748d710298bf827e2394c393caa13e
- SHA1
  
  835c020ebb7e20f1255ea539f095aa4be4da9fdd
- SHA256
  
  6c08ba3a25f7d1e380aead6863776a05f637d65f0e91a6cf3a857b5c9904b2b8
- SHA512
  
  c67b725c870949c0f8b614c083d320af2d8a81f75095bc440dd260286f39085afe4ebec9ef9b08cfa79d3d6337bd4509f7b55e201572ee189496e5764d126ffc
- SSDEEP
  
  6144:qxoT72vdWAMNZxOdxey8KODF8IvXgVKpL4n:qqT7EdWAMzQbg8dQ
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence