d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739 | Triage

Sharing

General

Target

d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739
Size

508KB
Sample

231010-qpnzzsdg3x
MD5

7cdc45bc90410af2a2e230658f217f8a
SHA1

0515a2346ccdd46653a6a7c9eb75321f4bd26c11
SHA256

d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739
SHA512

95b5e8127e82e2c067ad857da5a48a6af66fe26ee1f115900cf5cfaffa0099b5b8df444fc0beda07ad7bb78adca92f3e3efe943b8b5cf6d4bc8265c61acaffc4
SSDEEP

6144:mp+ggUaqL7bmBB+VXvup/y8NNiqxNhHt3bcBMjUeaSCBly1EfrTrPH5WKbXE80Z:S16Lpq4NiCH2BMjWT/rPZTbX

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739
- Size
  
  508KB
- MD5
  
  7cdc45bc90410af2a2e230658f217f8a
- SHA1
  
  0515a2346ccdd46653a6a7c9eb75321f4bd26c11
- SHA256
  
  d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739
- SHA512
  
  95b5e8127e82e2c067ad857da5a48a6af66fe26ee1f115900cf5cfaffa0099b5b8df444fc0beda07ad7bb78adca92f3e3efe943b8b5cf6d4bc8265c61acaffc4
- SSDEEP
  
  6144:mp+ggUaqL7bmBB+VXvup/y8NNiqxNhHt3bcBMjUeaSCBly1EfrTrPH5WKbXE80Z:S16Lpq4NiCH2BMjWT/rPZTbX
Score

7^/10

persistence
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2