Overview

overview

10

Static

static

b181a3dd62...a7.exe

windows7-x64

10

b181a3dd62...a7.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    b181a3dd6299db7e0ec281cbd7fcf07ebff7b1c5b9d83d84f2915592580da6a7

  • Size

    226KB

  • Sample

    221203-shsqpseh31

  • MD5

    514f1934130c7935e7f8914383bd06e0

  • SHA1

    f377e7fc15145463305c8f338753a40d36277fbb

  • SHA256

    b181a3dd6299db7e0ec281cbd7fcf07ebff7b1c5b9d83d84f2915592580da6a7

  • SHA512

    4fac8c76ca04c293822e060bf784f59e8712cdf8df096c646be5a1b782f20675132c6a04c29a85afc7a4f8d1ae6602d48341b795ef318769bc6b5d8d677cb380

  • SSDEEP

    3072:8pcnUDu5On4Kxyim8m+AkyJ79Q37TY5gfBViO5xJ5iPW:oNDu5OaimP97YYCfB0O5x

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      b181a3dd6299db7e0ec281cbd7fcf07ebff7b1c5b9d83d84f2915592580da6a7

    • Size

      226KB

    • MD5

      514f1934130c7935e7f8914383bd06e0

    • SHA1

      f377e7fc15145463305c8f338753a40d36277fbb

    • SHA256

      b181a3dd6299db7e0ec281cbd7fcf07ebff7b1c5b9d83d84f2915592580da6a7

    • SHA512

      4fac8c76ca04c293822e060bf784f59e8712cdf8df096c646be5a1b782f20675132c6a04c29a85afc7a4f8d1ae6602d48341b795ef318769bc6b5d8d677cb380

    • SSDEEP

      3072:8pcnUDu5On4Kxyim8m+AkyJ79Q37TY5gfBViO5xJ5iPW:oNDu5OaimP97YYCfB0O5x

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks