23c68cc557841bee5d6b1fa1006b8cf04da74929e46fd3d6649222dd4ddeab0d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cbaa2b088b5c90acd98ecedf30d9cb05
Size

241KB
Sample

240315-ryrb5sda66
MD5

cbaa2b088b5c90acd98ecedf30d9cb05
SHA1

90ea98f96f886c2ccdf138cb48c9dce8a0a79178
SHA256

23c68cc557841bee5d6b1fa1006b8cf04da74929e46fd3d6649222dd4ddeab0d
SHA512

5b859c0d8d58375772cc4910e39fbe13e304b143e4d20dd3472a7c4d8617c2a18c01a04c6be3f3e9da1b77c7f849a5c5cb7a2f6285b549bbda983e6e43b78c01
SSDEEP

6144:1PUZudjXmzJLRikel9uqOGw/SRB5mnOJVW6ANuqBbbM8s:1McdTmzZMkel9uqOGOSL5msWQqHNs

Score

7^/10

Malware Config

Targets

- Target
  
  cbaa2b088b5c90acd98ecedf30d9cb05
- Size
  
  241KB
- MD5
  
  cbaa2b088b5c90acd98ecedf30d9cb05
- SHA1
  
  90ea98f96f886c2ccdf138cb48c9dce8a0a79178
- SHA256
  
  23c68cc557841bee5d6b1fa1006b8cf04da74929e46fd3d6649222dd4ddeab0d
- SHA512
  
  5b859c0d8d58375772cc4910e39fbe13e304b143e4d20dd3472a7c4d8617c2a18c01a04c6be3f3e9da1b77c7f849a5c5cb7a2f6285b549bbda983e6e43b78c01
- SSDEEP
  
  6144:1PUZudjXmzJLRikel9uqOGw/SRB5mnOJVW6ANuqBbbM8s:1McdTmzZMkel9uqOGOSL5msWQqHNs
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2