Overview

overview

8

Static

static

8b22733602...c9.exe

windows7-x64

8

8b22733602...c9.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    8b2273360203bf16a005c4f33661eb3e05ca154b831878c00826bffaa7da61c9

  • Size

    178KB

  • Sample

    221201-1cpe4acg82

  • MD5

    eb415748b7b85e2f75975363d43ec179

  • SHA1

    ccaa98511b865b25588d5cd6d3adb49fdc9a57b2

  • SHA256

    8b2273360203bf16a005c4f33661eb3e05ca154b831878c00826bffaa7da61c9

  • SHA512

    2ffc8a93a4232c41dbdb0216b39bdcd9e140696bdeb14f6fee9604a73e534b4ca9a57a7436022d89c2bef47ec027faeb392edae30bd1501ee41bde7d4adc796e

  • SSDEEP

    3072:IlMIZH+0Ro2LF3tjdz1SdMAxAW7PDrTebv/WC1E/QPCNAJ95RyptzB749Qt81:k5zRoMhBTevMvW/Q6NK95Ryh71

Score
8/10
persistence

Malware Config

Targets

    • Target

      8b2273360203bf16a005c4f33661eb3e05ca154b831878c00826bffaa7da61c9

    • Size

      178KB

    • MD5

      eb415748b7b85e2f75975363d43ec179

    • SHA1

      ccaa98511b865b25588d5cd6d3adb49fdc9a57b2

    • SHA256

      8b2273360203bf16a005c4f33661eb3e05ca154b831878c00826bffaa7da61c9

    • SHA512

      2ffc8a93a4232c41dbdb0216b39bdcd9e140696bdeb14f6fee9604a73e534b4ca9a57a7436022d89c2bef47ec027faeb392edae30bd1501ee41bde7d4adc796e

    • SSDEEP

      3072:IlMIZH+0Ro2LF3tjdz1SdMAxAW7PDrTebv/WC1E/QPCNAJ95RyptzB749Qt81:k5zRoMhBTevMvW/Q6NK95Ryh71

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks