Overview

overview

10

Static

static

4cec024ea0...b6.exe

windows7-x64

10

4cec024ea0...b6.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4cec024ea0a7356c3092683cafd1e148e0feaf3cd28084bd2c86d626a41a0fb6

  • Size

    149KB

  • Sample

    221206-mc56ysha76

  • MD5

    0587112798ea1f8411a10c3cec53252b

  • SHA1

    55d95d6b5732751d42ba1d3fca39215f0299c59c

  • SHA256

    4cec024ea0a7356c3092683cafd1e148e0feaf3cd28084bd2c86d626a41a0fb6

  • SHA512

    5d738729f6834e77fcf60a7f5d709c52af5611177a98fdd1fc8c93283bc3133b36631e4271379cbb91e7ec1f946716794fab2390bf19b65f812b875f765de6dc

  • SSDEEP

    3072:PF3n01v9VAm1irvRDZFTI10ODS/OeYW5T8uI9UkDeqKpkGGVQ:POrERD/k0QSGeNdkDTJGGVQ

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4cec024ea0a7356c3092683cafd1e148e0feaf3cd28084bd2c86d626a41a0fb6

    • Size

      149KB

    • MD5

      0587112798ea1f8411a10c3cec53252b

    • SHA1

      55d95d6b5732751d42ba1d3fca39215f0299c59c

    • SHA256

      4cec024ea0a7356c3092683cafd1e148e0feaf3cd28084bd2c86d626a41a0fb6

    • SHA512

      5d738729f6834e77fcf60a7f5d709c52af5611177a98fdd1fc8c93283bc3133b36631e4271379cbb91e7ec1f946716794fab2390bf19b65f812b875f765de6dc

    • SSDEEP

      3072:PF3n01v9VAm1irvRDZFTI10ODS/OeYW5T8uI9UkDeqKpkGGVQ:POrERD/k0QSGeNdkDTJGGVQ

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks