Overview

overview

10

Static

static

23b6f5a52d...7b.exe

windows7-x64

10

23b6f5a52d...7b.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    23b6f5a52dfd922281a9792771ac5a5641c843a17f7436c84a6a04ca2877197b

  • Size

    267KB

  • Sample

    221201-gy3p3afa4x

  • MD5

    bdda13db7b73f2b601ab2c541ef795ed

  • SHA1

    cee04f012c4504cbb5eaa8ceaa37b216e8bf0faf

  • SHA256

    23b6f5a52dfd922281a9792771ac5a5641c843a17f7436c84a6a04ca2877197b

  • SHA512

    24fd4902350d61b28cc9ffffcffb1fed77dc8ab779c71450a2b2a7f25c1e333616ecc63271fddac1f6982c2d8130812cebc6537f28ce6acf809e23656b8ee92d

  • SSDEEP

    6144:Yhwah+Z6eBmqYW6xS84mzpOFtnVMaup+yCqDRrZ02uzng:YOBb6xSiOfn3uquRG2M

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      23b6f5a52dfd922281a9792771ac5a5641c843a17f7436c84a6a04ca2877197b

    • Size

      267KB

    • MD5

      bdda13db7b73f2b601ab2c541ef795ed

    • SHA1

      cee04f012c4504cbb5eaa8ceaa37b216e8bf0faf

    • SHA256

      23b6f5a52dfd922281a9792771ac5a5641c843a17f7436c84a6a04ca2877197b

    • SHA512

      24fd4902350d61b28cc9ffffcffb1fed77dc8ab779c71450a2b2a7f25c1e333616ecc63271fddac1f6982c2d8130812cebc6537f28ce6acf809e23656b8ee92d

    • SSDEEP

      6144:Yhwah+Z6eBmqYW6xS84mzpOFtnVMaup+yCqDRrZ02uzng:YOBb6xSiOfn3uquRG2M

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks