Overview

overview

10

Static

static

3

HEUR-Trojan.Win32.exe

windows7-x64

10

HEUR-Trojan.Win32.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan.Win32.Generic-d9c49283e3e13a99782427ebd5e373bfd47293bbc89cb6a5f4ca675c9563ec4c

  • Size

    138KB

  • Sample

    230425-v1eynsdg4t

  • MD5

    cfa679562fd9617fac6a48c9675dcea9

  • SHA1

    9cebe23223aef35aa45bf9d6473c0a18f89006db

  • SHA256

    d9c49283e3e13a99782427ebd5e373bfd47293bbc89cb6a5f4ca675c9563ec4c

  • SHA512

    a0002d15fe2c91d77ad6f6539bbd3d7721ae76fb98573ba242821b00b76ef3abaa8e245d9ac58e1c328359fd3244fce158fffbcd7c9e740a99575104b2b2b060

  • SSDEEP

    3072:5M1BjoYNXoKDIJBXJPw45QvyBX94Z8L/YnfotzuK42fukRjXIUwJ9aj8uZ9:5MMYNXqBBwfvyj4qL2s5uCwJ8j8i9

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      HEUR-Trojan.Win32.Generic-d9c49283e3e13a99782427ebd5e373bfd47293bbc89cb6a5f4ca675c9563ec4c

    • Size

      138KB

    • MD5

      cfa679562fd9617fac6a48c9675dcea9

    • SHA1

      9cebe23223aef35aa45bf9d6473c0a18f89006db

    • SHA256

      d9c49283e3e13a99782427ebd5e373bfd47293bbc89cb6a5f4ca675c9563ec4c

    • SHA512

      a0002d15fe2c91d77ad6f6539bbd3d7721ae76fb98573ba242821b00b76ef3abaa8e245d9ac58e1c328359fd3244fce158fffbcd7c9e740a99575104b2b2b060

    • SSDEEP

      3072:5M1BjoYNXoKDIJBXJPw45QvyBX94Z8L/YnfotzuK42fukRjXIUwJ9aj8uZ9:5MMYNXqBBwfvyj4qL2s5uCwJ8j8i9

    Score
    10/10
    evasionpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks