Overview

overview

8

Static

static

825334b236...65.exe

windows7-x64

8

825334b236...65.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    825334b236c8d3b08736c1e59e94db5655c9bb040bee00c3fd1eb36081035065

  • Size

    203KB

  • Sample

    221201-14kafsae8t

  • MD5

    4987a95a438dedbebeb93108505b8ad2

  • SHA1

    6dcdbe9a3e82bc3e1ae8ec95c1991880a066bcf5

  • SHA256

    825334b236c8d3b08736c1e59e94db5655c9bb040bee00c3fd1eb36081035065

  • SHA512

    72a8c3c5a6139ca5b2092849ffd45ee7923fb06a775afa005da30b917a81018588a402d4e9bdc9e931c87fe32e4c4c9759ced87439e6d9076dbc4e44207aed65

  • SSDEEP

    3072:KlNACSyi0+33WliWD/SL2mTKf0O+g3s+wVc/oNH4d/AaJXpknkT0fEfPh:KACti0U3WEWDmDmLLwTNe/A2ykTPH

Score
8/10
persistence

Malware Config

Targets

    • Target

      825334b236c8d3b08736c1e59e94db5655c9bb040bee00c3fd1eb36081035065

    • Size

      203KB

    • MD5

      4987a95a438dedbebeb93108505b8ad2

    • SHA1

      6dcdbe9a3e82bc3e1ae8ec95c1991880a066bcf5

    • SHA256

      825334b236c8d3b08736c1e59e94db5655c9bb040bee00c3fd1eb36081035065

    • SHA512

      72a8c3c5a6139ca5b2092849ffd45ee7923fb06a775afa005da30b917a81018588a402d4e9bdc9e931c87fe32e4c4c9759ced87439e6d9076dbc4e44207aed65

    • SSDEEP

      3072:KlNACSyi0+33WliWD/SL2mTKf0O+g3s+wVc/oNH4d/AaJXpknkT0fEfPh:KACti0U3WEWDmDmLLwTNe/A2ykTPH

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks