Overview

overview

10

Static

static

abd0f3b2b9...94.exe

windows7-x64

10

abd0f3b2b9...94.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    abd0f3b2b93901db2a5155aed2cfbf366beb9446bbe4020845694bb535bdf094

  • Size

    199KB

  • Sample

    221203-s1kstacg57

  • MD5

    623591613f5e3a335508169bdb41f7ec

  • SHA1

    414aeee0d589177a2d5442fd8afed7557d92a25a

  • SHA256

    abd0f3b2b93901db2a5155aed2cfbf366beb9446bbe4020845694bb535bdf094

  • SHA512

    e24a0b8ef6f225ed7d7bca71af5b3a0245b98e1436125bb731c4b3e8a6590927d18c20c160d3b0bcb980c39c32d63ad80668adc3263263843ff27039bd0279f4

  • SSDEEP

    3072:3a0Tdmo0aet3r7Mq4R3b1EJaXK+eC7aYUanTTBzP1XpVEN5w9:3R0ou3r7Mnr1EV+eOZT9nVE3w9

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      abd0f3b2b93901db2a5155aed2cfbf366beb9446bbe4020845694bb535bdf094

    • Size

      199KB

    • MD5

      623591613f5e3a335508169bdb41f7ec

    • SHA1

      414aeee0d589177a2d5442fd8afed7557d92a25a

    • SHA256

      abd0f3b2b93901db2a5155aed2cfbf366beb9446bbe4020845694bb535bdf094

    • SHA512

      e24a0b8ef6f225ed7d7bca71af5b3a0245b98e1436125bb731c4b3e8a6590927d18c20c160d3b0bcb980c39c32d63ad80668adc3263263843ff27039bd0279f4

    • SSDEEP

      3072:3a0Tdmo0aet3r7Mq4R3b1EJaXK+eC7aYUanTTBzP1XpVEN5w9:3R0ou3r7Mnr1EV+eOZT9nVE3w9

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks