Overview

overview

8

Static

static

3

4ef0e08821...12.exe

windows7-x64

8

4ef0e08821...12.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    4ef0e08821563e44ce7a4b9dcdb7d161374b383bc379ac28d569165cca8ab212

  • Size

    853KB

  • Sample

    231114-x19jdsfc78

  • MD5

    885f929fbc0164c48f16ea91175a8857

  • SHA1

    c493c8ef44e722aa87c1b177203ab44baace8d8f

  • SHA256

    4ef0e08821563e44ce7a4b9dcdb7d161374b383bc379ac28d569165cca8ab212

  • SHA512

    4e0c8afb12a776a56bfc754e4c1dd8d402a9ea7d720cd051ab5cae72aff72cabf105e3b3404532857456aa3782b106cba30cd38cc879e3cb1f94ea4989b6e200

  • SSDEEP

    24576:kYrQc9s6kTMPw4AR9egs9v3vxlvxh++uBNdmsK:kq7s6kTMPcR9O7m8

Score
8/10
persistence

Malware Config

Targets

    • Target

      4ef0e08821563e44ce7a4b9dcdb7d161374b383bc379ac28d569165cca8ab212

    • Size

      853KB

    • MD5

      885f929fbc0164c48f16ea91175a8857

    • SHA1

      c493c8ef44e722aa87c1b177203ab44baace8d8f

    • SHA256

      4ef0e08821563e44ce7a4b9dcdb7d161374b383bc379ac28d569165cca8ab212

    • SHA512

      4e0c8afb12a776a56bfc754e4c1dd8d402a9ea7d720cd051ab5cae72aff72cabf105e3b3404532857456aa3782b106cba30cd38cc879e3cb1f94ea4989b6e200

    • SSDEEP

      24576:kYrQc9s6kTMPw4AR9egs9v3vxlvxh++uBNdmsK:kq7s6kTMPcR9O7m8

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks