1606cff26b476cd78c1f00d3ea19b8518ed0d600471f5cebf79f46cbcee7fe43 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e65176a8ff7d5b5600ff92c8646596f
Size

1000KB
Sample

231225-h7btdacfd6
MD5

0e65176a8ff7d5b5600ff92c8646596f
SHA1

ac1803a9855713caf498dbce5a233143083f8d64
SHA256

1606cff26b476cd78c1f00d3ea19b8518ed0d600471f5cebf79f46cbcee7fe43
SHA512

190436f14339ceb1cd60124d0ac1113a209a62ba6d5b9bcf105ddd42bd25480ae63e56a616ba30886890cf6fc594b4f8f2cc5fc4c039d8216f02bfbb7feda4c3
SSDEEP

12288:TDRgYyEIIewfqE6FuXK4TRd/V1kYrpH9PCECaBwQ2tb5JLrnylUPqt0gHDS7eyod:JPIINfqEoj4FLRpJJ1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Targets

- Target
  
  0e65176a8ff7d5b5600ff92c8646596f
- Size
  
  1000KB
- MD5
  
  0e65176a8ff7d5b5600ff92c8646596f
- SHA1
  
  ac1803a9855713caf498dbce5a233143083f8d64
- SHA256
  
  1606cff26b476cd78c1f00d3ea19b8518ed0d600471f5cebf79f46cbcee7fe43
- SHA512
  
  190436f14339ceb1cd60124d0ac1113a209a62ba6d5b9bcf105ddd42bd25480ae63e56a616ba30886890cf6fc594b4f8f2cc5fc4c039d8216f02bfbb7feda4c3
- SSDEEP
  
  12288:TDRgYyEIIewfqE6FuXK4TRd/V1kYrpH9PCECaBwQ2tb5JLrnylUPqt0gHDS7eyod:JPIINfqEoj4FLRpJJ1B+5vMiqt0gj2ed
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2