766a5dcafc9183d8f9cce7983055ba9598223222f5aff91cff6f3b59fcb652cd | Triage

Sharing

General

Target

00dda0f9971732936137da9040eb861d
Size

21KB
Sample

231229-xemshadbdm
MD5

00dda0f9971732936137da9040eb861d
SHA1

8177d0505a5169c812cea5d87debb7273c2a0e1f
SHA256

766a5dcafc9183d8f9cce7983055ba9598223222f5aff91cff6f3b59fcb652cd
SHA512

435c015615d1ffd8adbb3b6ee4060279ca8cffc098ad90c759aa0d8b3aab0224f752a8574fcef6ee76c88b5e1264ad3053b033018738fcb2d885f53012c84f65
SSDEEP

384:5PyZNjtU2mqYJTndZcop4ul1Qajq5bPzxmhFgm3H:RyZbq9pVlu6S7xmhFJ

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  00dda0f9971732936137da9040eb861d
- Size
  
  21KB
- MD5
  
  00dda0f9971732936137da9040eb861d
- SHA1
  
  8177d0505a5169c812cea5d87debb7273c2a0e1f
- SHA256
  
  766a5dcafc9183d8f9cce7983055ba9598223222f5aff91cff6f3b59fcb652cd
- SHA512
  
  435c015615d1ffd8adbb3b6ee4060279ca8cffc098ad90c759aa0d8b3aab0224f752a8574fcef6ee76c88b5e1264ad3053b033018738fcb2d885f53012c84f65
- SSDEEP
  
  384:5PyZNjtU2mqYJTndZcop4ul1Qajq5bPzxmhFgm3H:RyZbq9pVlu6S7xmhFJ
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies AppInit DLL entries
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2