aeb6450358df2f3a59406097a59d96521e431c9ee6fdddde91d8d5d7d1e36b0c | Triage

Sharing

General

Target

aeb6450358df2f3a59406097a59d96521e431c9ee6fdddde91d8d5d7d1e36b0c
Size

195KB
Sample

221201-x8ezradc84
MD5

b5c1b14f6748b5f5b058669f0550740f
SHA1

40e898f47d6c34d2b1db2c0578ec3df97fd1969d
SHA256

aeb6450358df2f3a59406097a59d96521e431c9ee6fdddde91d8d5d7d1e36b0c
SHA512

4a02786dec3f7e3f99db5ef142c64194578f8354873be37ff55bcfcf70a489933e408d42e44a70b5d417b7e9192870f8da4ebcb276d43198a7fc85e73add96c3
SSDEEP

6144:btsoKp6CIcuM0NgrVjO8L84avimPKaYa0X5TGXLuC7m:p83INxmrVjz84+imFx0XVeLzm

Score

10^/10

evasion

Malware Config

Targets

- Target
  
  aeb6450358df2f3a59406097a59d96521e431c9ee6fdddde91d8d5d7d1e36b0c
- Size
  
  195KB
- MD5
  
  b5c1b14f6748b5f5b058669f0550740f
- SHA1
  
  40e898f47d6c34d2b1db2c0578ec3df97fd1969d
- SHA256
  
  aeb6450358df2f3a59406097a59d96521e431c9ee6fdddde91d8d5d7d1e36b0c
- SHA512
  
  4a02786dec3f7e3f99db5ef142c64194578f8354873be37ff55bcfcf70a489933e408d42e44a70b5d417b7e9192870f8da4ebcb276d43198a7fc85e73add96c3
- SSDEEP
  
  6144:btsoKp6CIcuM0NgrVjO8L84avimPKaYa0X5TGXLuC7m:p83INxmrVjz84+imFx0XVeLzm
Score

10^/10

evasion
- Modifies security service
  evasion
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2