01c0e038db428063891b418cd9d2fa5d3976d24986256f074a035af6e71efe40 | Triage

Sharing

General

Target

8ff65f2ebcd8a7f30e4faf86a63e76d2
Size

506KB
Sample

240204-x64kbsbbbk
MD5

8ff65f2ebcd8a7f30e4faf86a63e76d2
SHA1

519a53191081cd9be09af29cf10422446272cc7c
SHA256

01c0e038db428063891b418cd9d2fa5d3976d24986256f074a035af6e71efe40
SHA512

2adca9205b526c16c7b7167b6ccf6fbda284e036d5f98f61237cb8fea01b4f61eb47e0a94e8cba81c944d48cba87a96103e70158c0886e50944e48c8032fe896
SSDEEP

12288:V8SFdwOZ3vczsA7Y93ifMFxFwhF/LVAXoaAuTzbRwh8:V8iwmc4A7Yt0OCn/LCXoaAuLWh8

Score

7^/10

Malware Config

Targets

- Target
  
  8ff65f2ebcd8a7f30e4faf86a63e76d2
- Size
  
  506KB
- MD5
  
  8ff65f2ebcd8a7f30e4faf86a63e76d2
- SHA1
  
  519a53191081cd9be09af29cf10422446272cc7c
- SHA256
  
  01c0e038db428063891b418cd9d2fa5d3976d24986256f074a035af6e71efe40
- SHA512
  
  2adca9205b526c16c7b7167b6ccf6fbda284e036d5f98f61237cb8fea01b4f61eb47e0a94e8cba81c944d48cba87a96103e70158c0886e50944e48c8032fe896
- SSDEEP
  
  12288:V8SFdwOZ3vczsA7Y93ifMFxFwhF/LVAXoaAuTzbRwh8:V8iwmc4A7Yt0OCn/LCXoaAuLWh8
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2