Overview

overview

8

Static

static

875c816742...85.exe

windows7-x64

8

875c816742...85.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    875c81674276b64d5668bfc49d31aa7a47774c6b94c10176474fa1cbf7aaf785

  • Size

    197KB

  • Sample

    221129-g2e36sga6y

  • MD5

    617abfe802b58600269e64cf068ba823

  • SHA1

    863311a174bbfca26b9509d7d1d7d3e99438b059

  • SHA256

    875c81674276b64d5668bfc49d31aa7a47774c6b94c10176474fa1cbf7aaf785

  • SHA512

    3c9efd0d386cc4cf55de3fc70d1e64eb2e0692a88bd0ca29a624699e1b65d7ecb94ccc14addd2e51dfdb7d34e9457f57fbc1a104b90bfdf2a911e162a7807612

  • SSDEEP

    3072:UnqrikalTzpObs3UFnssUoMu8V/zFd0POpRnnr2tEkXNprbbrWM5+QcdLdJx:UqrikqTFwMQilzjxRrtkNprbd5+n/D

Score
8/10
persistence

Malware Config

Targets

    • Target

      875c81674276b64d5668bfc49d31aa7a47774c6b94c10176474fa1cbf7aaf785

    • Size

      197KB

    • MD5

      617abfe802b58600269e64cf068ba823

    • SHA1

      863311a174bbfca26b9509d7d1d7d3e99438b059

    • SHA256

      875c81674276b64d5668bfc49d31aa7a47774c6b94c10176474fa1cbf7aaf785

    • SHA512

      3c9efd0d386cc4cf55de3fc70d1e64eb2e0692a88bd0ca29a624699e1b65d7ecb94ccc14addd2e51dfdb7d34e9457f57fbc1a104b90bfdf2a911e162a7807612

    • SSDEEP

      3072:UnqrikalTzpObs3UFnssUoMu8V/zFd0POpRnnr2tEkXNprbbrWM5+QcdLdJx:UqrikqTFwMQilzjxRrtkNprbd5+n/D

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks