Overview

overview

10

Static

static

3

4f749a8cc9...6f.exe

windows7-x64

10

4f749a8cc9...6f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f749a8cc9c570d1c61feafe433b1e6f.exe

  • Size

    381KB

  • Sample

    231230-tyslbaacen

  • MD5

    4f749a8cc9c570d1c61feafe433b1e6f

  • SHA1

    39c1be99061596587ef547b248edf0298cba9dec

  • SHA256

    3aa1de50ef1ad0cd07e7b0beb870162474522685c67187b2d62f94977c2b6ad7

  • SHA512

    96e87da556e04e07476e8ee94cc1ba73985fe0f29e00d24b92ac201ce8f1ca6e390cb3760b2aeb34d920390ea54fb61673613a9a05036b973867c68cdd4e812c

  • SSDEEP

    3072:q+AEoOscDUWpXfgp9ZglH5u3goLM+i/+d9AlNkOhDNHEZ8Vjzg2fYG2lO/BZ:qVexpPgsuQkM+igArXhVke

Score
10/10
persistence

Malware Config

Targets

    • Target

      4f749a8cc9c570d1c61feafe433b1e6f.exe

    • Size

      381KB

    • MD5

      4f749a8cc9c570d1c61feafe433b1e6f

    • SHA1

      39c1be99061596587ef547b248edf0298cba9dec

    • SHA256

      3aa1de50ef1ad0cd07e7b0beb870162474522685c67187b2d62f94977c2b6ad7

    • SHA512

      96e87da556e04e07476e8ee94cc1ba73985fe0f29e00d24b92ac201ce8f1ca6e390cb3760b2aeb34d920390ea54fb61673613a9a05036b973867c68cdd4e812c

    • SSDEEP

      3072:q+AEoOscDUWpXfgp9ZglH5u3goLM+i/+d9AlNkOhDNHEZ8Vjzg2fYG2lO/BZ:qVexpPgsuQkM+igArXhVke

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks