Overview

overview

8

Static

static

c92ccaa19f...f5.exe

windows7-x64

8

c92ccaa19f...f5.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c92ccaa19fc51596d29d9b55be7dd60f3239aaa7c7d0f47ae717532cd14df8f5

  • Size

    161KB

  • Sample

    221203-qhdknsgd5w

  • MD5

    63d34ad1c9174f4e087b1ee821bb2e6b

  • SHA1

    196d7446de0e7acba173e303a7cd78faa3f16954

  • SHA256

    c92ccaa19fc51596d29d9b55be7dd60f3239aaa7c7d0f47ae717532cd14df8f5

  • SHA512

    893780d2c3759ba21753f884bb46272e00908641d474797d460a808cd68ddd05c087407fec0da45135ebd489b33aa8a7a9e6dbbd0ca603c9d4302279b29cd418

  • SSDEEP

    3072:OLAfT489k8WRldsZHXIFvQKqh+drbuKeZIdcl5TzUvtRJEa3mLikk:AArT+/dsZ4/iOb/kIClxoEnikk

Score
8/10
persistence

Malware Config

Targets

    • Target

      c92ccaa19fc51596d29d9b55be7dd60f3239aaa7c7d0f47ae717532cd14df8f5

    • Size

      161KB

    • MD5

      63d34ad1c9174f4e087b1ee821bb2e6b

    • SHA1

      196d7446de0e7acba173e303a7cd78faa3f16954

    • SHA256

      c92ccaa19fc51596d29d9b55be7dd60f3239aaa7c7d0f47ae717532cd14df8f5

    • SHA512

      893780d2c3759ba21753f884bb46272e00908641d474797d460a808cd68ddd05c087407fec0da45135ebd489b33aa8a7a9e6dbbd0ca603c9d4302279b29cd418

    • SSDEEP

      3072:OLAfT489k8WRldsZHXIFvQKqh+drbuKeZIdcl5TzUvtRJEa3mLikk:AArT+/dsZ4/iOb/kIClxoEnikk

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks