92e4cc38e3f5bdf7a6bdab53b92a6d6191ae9f9d5e1931a9e617c47fc2ed37fe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b495d599069e38ec8f0e1adb94e7087
Size

506KB
Sample

240108-ndsspagegj
MD5

4b495d599069e38ec8f0e1adb94e7087
SHA1

47c970dbe6fc003893a6bce45727ef3e010d6ad8
SHA256

92e4cc38e3f5bdf7a6bdab53b92a6d6191ae9f9d5e1931a9e617c47fc2ed37fe
SHA512

2a8f867e7dcc099bf25ac848eb6fd85c160d612f3d2813d245a21606455d6473035b92decbc9924ae8592a8849f2d2fad9091bc87b3e2c945c198334ca148085
SSDEEP

12288:w00akFcjwhDsoT909K5VaueXot7VEsYwAwwBgwyZ7NREVg4Fr:wImZqC9oK7JeXor+7siVfr

Score

7^/10

Malware Config

Targets

- Target
  
  4b495d599069e38ec8f0e1adb94e7087
- Size
  
  506KB
- MD5
  
  4b495d599069e38ec8f0e1adb94e7087
- SHA1
  
  47c970dbe6fc003893a6bce45727ef3e010d6ad8
- SHA256
  
  92e4cc38e3f5bdf7a6bdab53b92a6d6191ae9f9d5e1931a9e617c47fc2ed37fe
- SHA512
  
  2a8f867e7dcc099bf25ac848eb6fd85c160d612f3d2813d245a21606455d6473035b92decbc9924ae8592a8849f2d2fad9091bc87b3e2c945c198334ca148085
- SSDEEP
  
  12288:w00akFcjwhDsoT909K5VaueXot7VEsYwAwwBgwyZ7NREVg4Fr:wImZqC9oK7JeXor+7siVfr
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2