ad49922ff971c41db1970d3cce0430fd226201dc4b55a0fb2183e09eaff6e191 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad49922ff971c41db1970d3cce0430fd226201dc4b55a0fb2183e09eaff6e191
Size

187KB
Sample

221205-k6cemaab2v
MD5

1439945e46dc442df02d25b2936d3eb0
SHA1

4e100abeafec831b7bee904c5a8467e0a9e2254c
SHA256

ad49922ff971c41db1970d3cce0430fd226201dc4b55a0fb2183e09eaff6e191
SHA512

9a2dc91395d8638f52aba6de71e41fd38bea98f6c8db37f22dee1f944b4822bc3dc0201e4bb24bae32e0fa9bfb94992a7f3934f8649203012a91e83ae41f9d0f
SSDEEP

1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqLoPVilg82HhtBEOQMvdoS:FW+1oS4l5OeuQdrmwvL8Eqbk

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  ad49922ff971c41db1970d3cce0430fd226201dc4b55a0fb2183e09eaff6e191
- Size
  
  187KB
- MD5
  
  1439945e46dc442df02d25b2936d3eb0
- SHA1
  
  4e100abeafec831b7bee904c5a8467e0a9e2254c
- SHA256
  
  ad49922ff971c41db1970d3cce0430fd226201dc4b55a0fb2183e09eaff6e191
- SHA512
  
  9a2dc91395d8638f52aba6de71e41fd38bea98f6c8db37f22dee1f944b4822bc3dc0201e4bb24bae32e0fa9bfb94992a7f3934f8649203012a91e83ae41f9d0f
- SSDEEP
  
  1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqLoPVilg82HhtBEOQMvdoS:FW+1oS4l5OeuQdrmwvL8Eqbk
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2