6ac986e8a1d186735ff4116474abb8de5da5cb51c3cc980bc21c37b4cdeb7b62

Resubmissions

02/05/2023, 11:37

230502-nrl73aah467

25/04/2023, 12:30

230425-ppgp8scb5v10

Sharing

Copy URL Twitter E-mail

General

Target
DOCUMENT.exe
Size 715KB
Sample230502-nrl73aah46
SHA256 6ac986e8a1d186735ff4116474abb8de5da5cb51c3cc980bc21c37b4cdeb7b62
MD5 6a4400b6d5ded18fff7c2f6886814d0a
SHA1 dc41822acc8edf8d0e130321cbb53f5c1186075a
SHA512 de2fbb159e3318d691040680a6995ac47cbb28428f5a3da80d04d677f7d6614b61f28881566fc5e48be3eb8f90a55d7cd5d1e13514ce9f6c9449db9ee659e5ff
SSDEEP 12288:Gzt8QKGxDsV/VQyD5p0mwzO52MOCwRm+kg+QXLzlTT45P07dNVPv31mdbzf1BRCg:GzKQRxAJLwPm+3PX945INVPdmJf1BUTc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Targets

- Target
  DOCUMENT.exe
- Size 715KB
- SHA256 6ac986e8a1d186735ff4116474abb8de5da5cb51c3cc980bc21c37b4cdeb7b62
- MD5 6a4400b6d5ded18fff7c2f6886814d0a
- SHA1 dc41822acc8edf8d0e130321cbb53f5c1186075a
- SHA512 de2fbb159e3318d691040680a6995ac47cbb28428f5a3da80d04d677f7d6614b61f28881566fc5e48be3eb8f90a55d7cd5d1e13514ce9f6c9449db9ee659e5ff
- SSDEEP 12288:Gzt8QKGxDsV/VQyD5p0mwzO52MOCwRm+kg+QXLzlTT45P07dNVPv31mdbzf1BRCg:GzKQRxAJLwPm+3PX945INVPdmJf1BUTc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks QEMU agent file

Loads dropped DLL

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2