Overview

overview

10

Static

static

adf5d187bb...33.exe

windows7-x64

10

adf5d187bb...33.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    adf5d187bb22f459b8f11aa0f61133b532ae16b6625d55d072388bc21c34b933

  • Size

    179KB

  • Sample

    221203-st7n1acc23

  • MD5

    01eab053a29f9e2395a6b15ba63c6730

  • SHA1

    dc2955c6a5c357e06bdf68530085346c43a867fd

  • SHA256

    adf5d187bb22f459b8f11aa0f61133b532ae16b6625d55d072388bc21c34b933

  • SHA512

    f9bc63c851d5b0a74a4dcac7f4bdef8e3a94c1016a0cb350427e4c4e0bb48d91804042bfb8d4ba4ab5293c84fc7845700ae451eda1a7c79dc89101fa99a55862

  • SSDEEP

    3072:cIkpRBgC/Qlj4Jad+KaiqUuDJvYaerBgwK1tHcX7a:uR7Q15+KwUu1waJP8

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      adf5d187bb22f459b8f11aa0f61133b532ae16b6625d55d072388bc21c34b933

    • Size

      179KB

    • MD5

      01eab053a29f9e2395a6b15ba63c6730

    • SHA1

      dc2955c6a5c357e06bdf68530085346c43a867fd

    • SHA256

      adf5d187bb22f459b8f11aa0f61133b532ae16b6625d55d072388bc21c34b933

    • SHA512

      f9bc63c851d5b0a74a4dcac7f4bdef8e3a94c1016a0cb350427e4c4e0bb48d91804042bfb8d4ba4ab5293c84fc7845700ae451eda1a7c79dc89101fa99a55862

    • SSDEEP

      3072:cIkpRBgC/Qlj4Jad+KaiqUuDJvYaerBgwK1tHcX7a:uR7Q15+KwUu1waJP8

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks