549f6b447fff52990f9b3bf2aba78aa276acc59b85f5b684aa7b09db35cff898 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

79dc859784dd39cbe9569d220e49fe00
Size

506KB
Sample

240127-la4pnshcf2
MD5

79dc859784dd39cbe9569d220e49fe00
SHA1

202d9e6e66f98cb1236d5d1d4ba7516894d43e4e
SHA256

549f6b447fff52990f9b3bf2aba78aa276acc59b85f5b684aa7b09db35cff898
SHA512

d7e84fb50e216865eab00a7686182414ab2d67e017beb896be81571a0c21c2d9bddbc69a13d156bbce4f7df548e7d8c5e773674903e5a5345ee67932c6a5207b
SSDEEP

12288:AwlWztlLbkYRB59u40JjmE+INdLkBigrDMFcrmaI:dWzD/kKwZmE+INd2isDXyr

Score

7^/10

Malware Config

Targets

- Target
  
  79dc859784dd39cbe9569d220e49fe00
- Size
  
  506KB
- MD5
  
  79dc859784dd39cbe9569d220e49fe00
- SHA1
  
  202d9e6e66f98cb1236d5d1d4ba7516894d43e4e
- SHA256
  
  549f6b447fff52990f9b3bf2aba78aa276acc59b85f5b684aa7b09db35cff898
- SHA512
  
  d7e84fb50e216865eab00a7686182414ab2d67e017beb896be81571a0c21c2d9bddbc69a13d156bbce4f7df548e7d8c5e773674903e5a5345ee67932c6a5207b
- SSDEEP
  
  12288:AwlWztlLbkYRB59u40JjmE+INdLkBigrDMFcrmaI:dWzD/kKwZmE+INd2isDXyr
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2