9381fce6c0fa0513ce1a583d92e786a1e281152de95b9ec124db3f2216e798b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9381fce6c0fa0513ce1a583d92e786a1e281152de95b9ec124db3f2216e798b9
Size

134KB
Sample

221129-gzdgkacg46
MD5

3396c7fa8cc3ba42928d19158813c920
SHA1

266823dc6c4f6bb42abf5b8a62f74fd894eff6ee
SHA256

9381fce6c0fa0513ce1a583d92e786a1e281152de95b9ec124db3f2216e798b9
SHA512

491d1f1a04e0b30b959059d8218d90de71f7b561238675d22a8581c0c95840a04cb3f393bbb140fbe9ca77641fc47d62d60052501efe5506a53c5b9bd57370a7
SSDEEP

1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anqa42aFeaAA:2++TFnoWTTYBB1hHgN1AnqmaFerA

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  9381fce6c0fa0513ce1a583d92e786a1e281152de95b9ec124db3f2216e798b9
- Size
  
  134KB
- MD5
  
  3396c7fa8cc3ba42928d19158813c920
- SHA1
  
  266823dc6c4f6bb42abf5b8a62f74fd894eff6ee
- SHA256
  
  9381fce6c0fa0513ce1a583d92e786a1e281152de95b9ec124db3f2216e798b9
- SHA512
  
  491d1f1a04e0b30b959059d8218d90de71f7b561238675d22a8581c0c95840a04cb3f393bbb140fbe9ca77641fc47d62d60052501efe5506a53c5b9bd57370a7
- SSDEEP
  
  1536:8haN2fh0+TTQInoWGJcJJleqt1+Wgx3lFnHmleHSWgLAyXnnLm+Anqa42aFeaAA:2++TFnoWTTYBB1hHgN1AnqmaFerA
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2