Overview

overview

8

Static

static

aa377e8482...21.exe

windows7-x64

8

aa377e8482...21.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa377e8482a2090eaf31c07c85e5d273a753ff36173b11f007c878907fd8be21

  • Size

    196KB

  • Sample

    221129-qm487acg57

  • MD5

    9de659068824ea5cb5c3ef413b739084

  • SHA1

    15c73fc76dc7ab13fa2b0823dd710e48265139b5

  • SHA256

    aa377e8482a2090eaf31c07c85e5d273a753ff36173b11f007c878907fd8be21

  • SHA512

    9b9840d0f8a2cb9897d4627620ccda31e6e632cb3635273fbaff9281d903046ebafac4eb2fbf11640436c4c915b49523b935a9f03a41f51490e16396a8c518dc

  • SSDEEP

    3072:ogniFLb8zQduAVW861PCI0v//05imQ6glYghaX9Pv8mcDnJUKsas+xPCUZKkiIHJ:bQLb8Zz0IW/MnQZYTXJho/i+xPT3vJ

Score
8/10
persistence

Malware Config

Targets

    • Target

      aa377e8482a2090eaf31c07c85e5d273a753ff36173b11f007c878907fd8be21

    • Size

      196KB

    • MD5

      9de659068824ea5cb5c3ef413b739084

    • SHA1

      15c73fc76dc7ab13fa2b0823dd710e48265139b5

    • SHA256

      aa377e8482a2090eaf31c07c85e5d273a753ff36173b11f007c878907fd8be21

    • SHA512

      9b9840d0f8a2cb9897d4627620ccda31e6e632cb3635273fbaff9281d903046ebafac4eb2fbf11640436c4c915b49523b935a9f03a41f51490e16396a8c518dc

    • SSDEEP

      3072:ogniFLb8zQduAVW861PCI0v//05imQ6glYghaX9Pv8mcDnJUKsas+xPCUZKkiIHJ:bQLb8Zz0IW/MnQZYTXJho/i+xPT3vJ

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks