Overview

overview

8

Static

static

791a8293a1...3e.exe

windows7-x64

8

791a8293a1...3e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e

  • Size

    163KB

  • Sample

    221201-2h8atsca8x

  • MD5

    30dfe01b30835ef02bc7ed0c9d202470

  • SHA1

    21a7fc89ee9f67e7a2a495463d80091a7e70bec2

  • SHA256

    791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e

  • SHA512

    1ff3aab19bf270bb3786267e725700f9dd48b04fa5beb8fd2f3f1b795b82ed0582797499b4f0347c2de6d85017909e5bcadb0e3dc3ef9f0eb5c0c30aabbfbc8c

  • SSDEEP

    3072:CNvuPYzgSsgXHvbLXajMkfFkj+A57zBvg/w2xWE59b:mCEHHX6Mktw+I7zB6wY

Score
8/10
persistence

Malware Config

Targets

    • Target

      791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e

    • Size

      163KB

    • MD5

      30dfe01b30835ef02bc7ed0c9d202470

    • SHA1

      21a7fc89ee9f67e7a2a495463d80091a7e70bec2

    • SHA256

      791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e

    • SHA512

      1ff3aab19bf270bb3786267e725700f9dd48b04fa5beb8fd2f3f1b795b82ed0582797499b4f0347c2de6d85017909e5bcadb0e3dc3ef9f0eb5c0c30aabbfbc8c

    • SSDEEP

      3072:CNvuPYzgSsgXHvbLXajMkfFkj+A57zBvg/w2xWE59b:mCEHHX6Mktw+I7zB6wY

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks