b69294fc005cccba6fa7d857e45c3b8aac02e36713acf7780bdc16c8ea8b7f22 | Triage

Sharing

General

Target

b69294fc005cccba6fa7d857e45c3b8aac02e36713acf7780bdc16c8ea8b7f22
Size

176KB
Sample

221201-xnllssag58
MD5

dc367ded2689c91d76a1f62ccb62c35f
SHA1

4a3042be1df26b0874a8e956b72af4ace8d344b5
SHA256

b69294fc005cccba6fa7d857e45c3b8aac02e36713acf7780bdc16c8ea8b7f22
SHA512

f6f18b32707ed9630bb6285318c04c7458fb3d82e86d5fb8de637c99d89b502a9c211c33c95468284f4e7313a0c4ecb7748278ceb18feb0b684e62cffd5791ea
SSDEEP

3072:Yo9Ymi9PARe6gXz1BMEW2ig2APA07i9j2GwvTzx78SLHoeSKc5SSwiggK19z/596:Yo9CxARe60jMn+7iZ2GwvvBlH0Kc5SSa

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b69294fc005cccba6fa7d857e45c3b8aac02e36713acf7780bdc16c8ea8b7f22
- Size
  
  176KB
- MD5
  
  dc367ded2689c91d76a1f62ccb62c35f
- SHA1
  
  4a3042be1df26b0874a8e956b72af4ace8d344b5
- SHA256
  
  b69294fc005cccba6fa7d857e45c3b8aac02e36713acf7780bdc16c8ea8b7f22
- SHA512
  
  f6f18b32707ed9630bb6285318c04c7458fb3d82e86d5fb8de637c99d89b502a9c211c33c95468284f4e7313a0c4ecb7748278ceb18feb0b684e62cffd5791ea
- SSDEEP
  
  3072:Yo9Ymi9PARe6gXz1BMEW2ig2APA07i9j2GwvTzx78SLHoeSKc5SSwiggK19z/596:Yo9CxARe60jMn+7iZ2GwvvBlH0Kc5SSa
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2