Overview

overview

8

Static

static

3

a2c472f03c...40.exe

windows7-x64

8

a2c472f03c...40.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2c472f03c51a188df057d45db691e83bbe951ec9622c3415ca767e7a67bb840

  • Size

    672KB

  • Sample

    231114-xta29aed87

  • MD5

    a56b2ef7f53aa63867878679f7ebf870

  • SHA1

    a018114c0885cca99838a360b05eddc155b6b933

  • SHA256

    a2c472f03c51a188df057d45db691e83bbe951ec9622c3415ca767e7a67bb840

  • SHA512

    1cd016a9ff3462c26913d9ef023a4c3103343b62b94a5450d9de8644405653239cb6c9e2874397bd8294252416fcc2ba9cdc830215f0f14eed247e2dc037ebbc

  • SSDEEP

    12288:4PFY04OQg3ENmxwLqwGdBLymNr21GHnAEIS4mBVRTqeRKwpNt+:MFY04O8Nmx8qPXtckH3BVRTwwpq

Score
8/10
persistence

Malware Config

Targets

    • Target

      a2c472f03c51a188df057d45db691e83bbe951ec9622c3415ca767e7a67bb840

    • Size

      672KB

    • MD5

      a56b2ef7f53aa63867878679f7ebf870

    • SHA1

      a018114c0885cca99838a360b05eddc155b6b933

    • SHA256

      a2c472f03c51a188df057d45db691e83bbe951ec9622c3415ca767e7a67bb840

    • SHA512

      1cd016a9ff3462c26913d9ef023a4c3103343b62b94a5450d9de8644405653239cb6c9e2874397bd8294252416fcc2ba9cdc830215f0f14eed247e2dc037ebbc

    • SSDEEP

      12288:4PFY04OQg3ENmxwLqwGdBLymNr21GHnAEIS4mBVRTqeRKwpNt+:MFY04O8Nmx8qPXtckH3BVRTwwpq

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks