Overview

overview

10

Static

static

59cba8a825...15.exe

windows7-x64

10

59cba8a825...15.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    59cba8a825bc689747afddec81f6578676c1b4efee642393821e06ac06b61e15

  • Size

    297KB

  • Sample

    221205-rnpessbh9x

  • MD5

    2650e55f76232d9245ec5b12a5e190a0

  • SHA1

    76d7e3eb24dbdece105dca881bbd79728e22e2df

  • SHA256

    59cba8a825bc689747afddec81f6578676c1b4efee642393821e06ac06b61e15

  • SHA512

    97385b89a3582cfd22a70f3267da0d70e6139721c8610bc2a70f2c00eb7cf263f988174d381892349c0e2ebc64facc4c4c6c4ceb0c35514fbf50c9f8f33a2d32

  • SSDEEP

    6144:uxFR7lcTiGTAhfNbwGpjNxS42unI7TQmnms3jKRYUEy:uxrOTAXm1nnvf

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      59cba8a825bc689747afddec81f6578676c1b4efee642393821e06ac06b61e15

    • Size

      297KB

    • MD5

      2650e55f76232d9245ec5b12a5e190a0

    • SHA1

      76d7e3eb24dbdece105dca881bbd79728e22e2df

    • SHA256

      59cba8a825bc689747afddec81f6578676c1b4efee642393821e06ac06b61e15

    • SHA512

      97385b89a3582cfd22a70f3267da0d70e6139721c8610bc2a70f2c00eb7cf263f988174d381892349c0e2ebc64facc4c4c6c4ceb0c35514fbf50c9f8f33a2d32

    • SSDEEP

      6144:uxFR7lcTiGTAhfNbwGpjNxS42unI7TQmnms3jKRYUEy:uxrOTAXm1nnvf

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks