Overview

overview

10

Static

static

61f5d39730...fc.exe

windows7-x64

10

61f5d39730...fc.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    61f5d39730261ee7251ae9364eb886a212622d7a7ef8dd383bd193d1c4e925fc

  • Size

    196KB

  • Sample

    221201-3c3c3abf33

  • MD5

    6924e2c500e9acbca7c0491abf022ede

  • SHA1

    2085b4b6240ed7937a3a591ff9528411bf6a4551

  • SHA256

    61f5d39730261ee7251ae9364eb886a212622d7a7ef8dd383bd193d1c4e925fc

  • SHA512

    54b0823893af89487f21aef62041786d57901510e5394eaf325ca3f9ea3a91cb58b12f2984b9303d8db43749d1b5d8ae9ce03244cea954ec3a55fec856eaba02

  • SSDEEP

    3072:YIc4PEfpuh+Iw5WP00AmxF8UFiDZWgrz0/pHtrD3n19Gz5vEvPlrvPqT:RP+4+lUF80CZb0/BtrD+1vEvtjPqT

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      61f5d39730261ee7251ae9364eb886a212622d7a7ef8dd383bd193d1c4e925fc

    • Size

      196KB

    • MD5

      6924e2c500e9acbca7c0491abf022ede

    • SHA1

      2085b4b6240ed7937a3a591ff9528411bf6a4551

    • SHA256

      61f5d39730261ee7251ae9364eb886a212622d7a7ef8dd383bd193d1c4e925fc

    • SHA512

      54b0823893af89487f21aef62041786d57901510e5394eaf325ca3f9ea3a91cb58b12f2984b9303d8db43749d1b5d8ae9ce03244cea954ec3a55fec856eaba02

    • SSDEEP

      3072:YIc4PEfpuh+Iw5WP00AmxF8UFiDZWgrz0/pHtrD3n19Gz5vEvPlrvPqT:RP+4+lUF80CZb0/BtrD+1vEvtjPqT

    Score
    10/10
    evasionpersistence

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks