327b7d5351a8368ee3bc30defc0ae479798c6ac01acf9f0375f569170089dd41 | Triage

Sharing

General

Target

327b7d5351a8368ee3bc30defc0ae479798c6ac01acf9f0375f569170089dd41
Size

426KB
Sample

231114-x2bczsfc87
MD5

c3e31ea4ff520e4b2dbed7476b4f3623
SHA1

16bbe1d984cd47a8188022db722745144daae689
SHA256

327b7d5351a8368ee3bc30defc0ae479798c6ac01acf9f0375f569170089dd41
SHA512

a482d1f1bbb51dca5b4e84d5e4860919a0314fbd64676a9f6889ce2fac02db886e96ef994b1695e772765a29727de0dc3246beb9386b9793d282a3a9fc1b4fff
SSDEEP

12288:SJpronalhD0fWAailY5L4BqERsOeMy20L:SJp8nYeaiKCBqZDMyJL

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  327b7d5351a8368ee3bc30defc0ae479798c6ac01acf9f0375f569170089dd41
- Size
  
  426KB
- MD5
  
  c3e31ea4ff520e4b2dbed7476b4f3623
- SHA1
  
  16bbe1d984cd47a8188022db722745144daae689
- SHA256
  
  327b7d5351a8368ee3bc30defc0ae479798c6ac01acf9f0375f569170089dd41
- SHA512
  
  a482d1f1bbb51dca5b4e84d5e4860919a0314fbd64676a9f6889ce2fac02db886e96ef994b1695e772765a29727de0dc3246beb9386b9793d282a3a9fc1b4fff
- SSDEEP
  
  12288:SJpronalhD0fWAailY5L4BqERsOeMy20L:SJp8nYeaiKCBqZDMyJL
Score

7^/10

persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2