Overview

overview

8

Static

static

3

acbb1db51e...9d.exe

windows7-x64

8

acbb1db51e...9d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acbb1db51ecd91c8b7e62cc75e532b32df89fcfc7f318e9f925d9a4521dbd89d

  • Size

    853KB

  • Sample

    231114-xhp22adb25

  • MD5

    dbf67f7f28604cab1644c0f6b7964a96

  • SHA1

    5e787962936e37a00826a4edae473e1cc8e7ace7

  • SHA256

    acbb1db51ecd91c8b7e62cc75e532b32df89fcfc7f318e9f925d9a4521dbd89d

  • SHA512

    5675c7a947fce4cfb0d2601274a1691daa892996d5f5c52e15f6042d8aeda40f35d275a85c4d39bed1a29c20d45da36777064d3304eb294e8109c217681dce89

  • SSDEEP

    24576:/ifxgP1zXgMG1kT0Gqgr1iuXXABG8L4Yfs:6fxgP18rOvqgrZHj8LJs

Score
8/10
persistence

Malware Config

Targets

    • Target

      acbb1db51ecd91c8b7e62cc75e532b32df89fcfc7f318e9f925d9a4521dbd89d

    • Size

      853KB

    • MD5

      dbf67f7f28604cab1644c0f6b7964a96

    • SHA1

      5e787962936e37a00826a4edae473e1cc8e7ace7

    • SHA256

      acbb1db51ecd91c8b7e62cc75e532b32df89fcfc7f318e9f925d9a4521dbd89d

    • SHA512

      5675c7a947fce4cfb0d2601274a1691daa892996d5f5c52e15f6042d8aeda40f35d275a85c4d39bed1a29c20d45da36777064d3304eb294e8109c217681dce89

    • SSDEEP

      24576:/ifxgP1zXgMG1kT0Gqgr1iuXXABG8L4Yfs:6fxgP18rOvqgrZHj8LJs

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks