Overview

overview

9

Static

static

e35f1cabe3...ed.exe

windows7-x64

9

e35f1cabe3...ed.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e35f1cabe359f5f777a5c4baf3b5fb3fd3b8d8f87d6359d4a3fc2f1080fdeeed

  • Size

    200KB

  • Sample

    221128-j111csgg97

  • MD5

    8d36e6b5fda8f4df23190fe046e84dfb

  • SHA1

    15ebe06af0ff95d8b428884d9f4e3dd032b7e41a

  • SHA256

    e35f1cabe359f5f777a5c4baf3b5fb3fd3b8d8f87d6359d4a3fc2f1080fdeeed

  • SHA512

    a7fefa1dfa8aa96c64151df67b240e226ae85073f1cf7db3ef4cdad90918a957b311f37b57431db6f962af6f348d01e02da7b0c3233524e6ec7d1fd84160286d

  • SSDEEP

    3072:THlma2Qygs0OLRwLiH2yIAT9X4tk+shCh+gsDlUzv/4AEuekNSxaCW:THlma2WhxiT8k+f9KlUrZOkNSs

Score
9/10
cryptonepackerpersistence

Malware Config

Targets

    • Target

      e35f1cabe359f5f777a5c4baf3b5fb3fd3b8d8f87d6359d4a3fc2f1080fdeeed

    • Size

      200KB

    • MD5

      8d36e6b5fda8f4df23190fe046e84dfb

    • SHA1

      15ebe06af0ff95d8b428884d9f4e3dd032b7e41a

    • SHA256

      e35f1cabe359f5f777a5c4baf3b5fb3fd3b8d8f87d6359d4a3fc2f1080fdeeed

    • SHA512

      a7fefa1dfa8aa96c64151df67b240e226ae85073f1cf7db3ef4cdad90918a957b311f37b57431db6f962af6f348d01e02da7b0c3233524e6ec7d1fd84160286d

    • SSDEEP

      3072:THlma2Qygs0OLRwLiH2yIAT9X4tk+shCh+gsDlUzv/4AEuekNSxaCW:THlma2WhxiT8k+f9KlUrZOkNSs

    Score
    9/10
    cryptonepackerpersistence

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                  Privilege Escalation

                    Tasks