Overview

overview

10

Static

static

3

8751033a76...0b.exe

windows7-x64

10

8751033a76...0b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8751033a7635d5292ee6acf6b7ce070b

  • Size

    255KB

  • Sample

    240201-tmrvmsbear

  • MD5

    8751033a7635d5292ee6acf6b7ce070b

  • SHA1

    043e6703de1bb3b80da086c3170a3a32ff0daa75

  • SHA256

    187af94549eb0421867470da250a14ad73e30252b91352a9a152fd55f2559eb9

  • SHA512

    1e01f144893dbcd157fbc560a9faa054c947b77667b7ad761888035a3930c24e4eaf84a1de18f1d5808d25ea97a32aa80cd0a0147c6d83774cdad876c3430188

  • SSDEEP

    6144:nNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:nNRdpgdRRoTCD4ijpoix

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      8751033a7635d5292ee6acf6b7ce070b

    • Size

      255KB

    • MD5

      8751033a7635d5292ee6acf6b7ce070b

    • SHA1

      043e6703de1bb3b80da086c3170a3a32ff0daa75

    • SHA256

      187af94549eb0421867470da250a14ad73e30252b91352a9a152fd55f2559eb9

    • SHA512

      1e01f144893dbcd157fbc560a9faa054c947b77667b7ad761888035a3930c24e4eaf84a1de18f1d5808d25ea97a32aa80cd0a0147c6d83774cdad876c3430188

    • SSDEEP

      6144:nNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:nNRdpgdRRoTCD4ijpoix

    Score
    10/10
    persistencediscovery

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks