Overview

overview

10

Static

static

3

0e3f138b30...14.exe

windows7-x64

10

0e3f138b30...14.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e3f138b3083f07d9c282ead13952414

  • Size

    242KB

  • Sample

    231230-ex2ehabfek

  • MD5

    0e3f138b3083f07d9c282ead13952414

  • SHA1

    735ed22fd571500fee32d49a2b25bd72c83a87ae

  • SHA256

    2b18ddb5377e8f8dee46667d360bede5d09a5e1d047ae99993d04e4f81840d51

  • SHA512

    ccb77e566485e037e33fb48630804b826a68c823a61ce738d708405376657b504107d9c1f9ae1c0e7ef9111c93e484e9a465c3ec68500a9619bdfa2751e905ae

  • SSDEEP

    6144:udXRrRvv7YdAh4qIDvzJvPSjGnuopYmK/i2amfD:u7Rvv8dSBIDvzxPOMuo3X2a4D

Score
10/10
persistence

Malware Config

Targets

    • Target

      0e3f138b3083f07d9c282ead13952414

    • Size

      242KB

    • MD5

      0e3f138b3083f07d9c282ead13952414

    • SHA1

      735ed22fd571500fee32d49a2b25bd72c83a87ae

    • SHA256

      2b18ddb5377e8f8dee46667d360bede5d09a5e1d047ae99993d04e4f81840d51

    • SHA512

      ccb77e566485e037e33fb48630804b826a68c823a61ce738d708405376657b504107d9c1f9ae1c0e7ef9111c93e484e9a465c3ec68500a9619bdfa2751e905ae

    • SSDEEP

      6144:udXRrRvv7YdAh4qIDvzJvPSjGnuopYmK/i2amfD:u7Rvv8dSBIDvzxPOMuo3X2a4D

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks