Overview

overview

10

Static

static

1

DEVMI.exe

windows7-x64

10

DEVMI.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    DEVMI.exe

  • Size

    5.8MB

  • Sample

    230425-y8dmcsef7w

  • MD5

    5f2f1ae240812065799e8c05d3a01aa7

  • SHA1

    e14d1c6a64f27267c688b695da84b7a9527a3d13

  • SHA256

    adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03

  • SHA512

    d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

  • SSDEEP

    98304:nFgc9lwquOMw7CRBgZXLzpYyAVIAPs0yFPJ+m0gfEOIdVZZMxy9/qbnbWYwhgI2Z:n2O6qLMwQKZXLzcqAPs08PJ+m0kEOIzi

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      DEVMI.exe

    • Size

      5.8MB

    • MD5

      5f2f1ae240812065799e8c05d3a01aa7

    • SHA1

      e14d1c6a64f27267c688b695da84b7a9527a3d13

    • SHA256

      adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03

    • SHA512

      d92339a954509b988b6eb3b7508182a7773489aa27ed88ddaf6c5f3a3f26f345c8463bf688b40cc99b9728bc47c1b4e1ad8175a9e07fe576a216c9521cb07f50

    • SSDEEP

      98304:nFgc9lwquOMw7CRBgZXLzpYyAVIAPs0yFPJ+m0gfEOIdVZZMxy9/qbnbWYwhgI2Z:n2O6qLMwQKZXLzcqAPs08PJ+m0kEOIzi

    Score
    10/10
    evasionpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks