b2330f29af18493f4ae05ad89bc7c58afe66dadbd4390e85ff6cd4ced7ecf17f | Triage

Sharing

General

Target

19583403832eccd1566d0ba9be4de07a
Size

471KB
Sample

231230-p96j4afgb6
MD5

19583403832eccd1566d0ba9be4de07a
SHA1

0bd4e2b1f1cb4ed3f1e4c4a08b0b30760da0119a
SHA256

b2330f29af18493f4ae05ad89bc7c58afe66dadbd4390e85ff6cd4ced7ecf17f
SHA512

0e6ec33e5db53ffcacc65820ad38536a6b4517caf28c6abeff0b34188ac20f2c4e0a1568c02bdba6deaf881cf758f7e4775540c26c63ea4bdaf3ee6e26994010
SSDEEP

12288:noZTq8dks+riBHDDaXbQ72RjPB0aDxfki4:nCqO+riBHD72Rjt

Score

7^/10

evasion

Malware Config

Targets

- Target
  
  19583403832eccd1566d0ba9be4de07a
- Size
  
  471KB
- MD5
  
  19583403832eccd1566d0ba9be4de07a
- SHA1
  
  0bd4e2b1f1cb4ed3f1e4c4a08b0b30760da0119a
- SHA256
  
  b2330f29af18493f4ae05ad89bc7c58afe66dadbd4390e85ff6cd4ced7ecf17f
- SHA512
  
  0e6ec33e5db53ffcacc65820ad38536a6b4517caf28c6abeff0b34188ac20f2c4e0a1568c02bdba6deaf881cf758f7e4775540c26c63ea4bdaf3ee6e26994010
- SSDEEP
  
  12288:noZTq8dks+riBHDDaXbQ72RjPB0aDxfki4:nCqO+riBHD72Rjt
Score

7^/10

evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2