Overview

overview

8

Static

static

3

ce2dba593e...8b.exe

windows7-x64

8

ce2dba593e...8b.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce2dba593ed3afedfa00a8de8887ec8b

  • Size

    140KB

  • Sample

    240316-qtrlnsea32

  • MD5

    ce2dba593ed3afedfa00a8de8887ec8b

  • SHA1

    6b3013cd9d10b9f20b418854f1363294e23ba7a4

  • SHA256

    78dbb664e2867fcd227510cf53111638990a15fe792ea04641f10aa9fcff1258

  • SHA512

    a24684aecbe0bb05c5f6a0dcca744133cb35277236563d710bbea12860ba0d7a858cb74e31ffae829a9786224f8d8ac4d4d99f2ebb1a0612680c7243f7c69fe9

  • SSDEEP

    3072:ZBWePozVRNzRMMTTpN28eNuvOkkFPl88bu28f:ZBNQ1PTH2FNDJ2Eu2s

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      ce2dba593ed3afedfa00a8de8887ec8b

    • Size

      140KB

    • MD5

      ce2dba593ed3afedfa00a8de8887ec8b

    • SHA1

      6b3013cd9d10b9f20b418854f1363294e23ba7a4

    • SHA256

      78dbb664e2867fcd227510cf53111638990a15fe792ea04641f10aa9fcff1258

    • SHA512

      a24684aecbe0bb05c5f6a0dcca744133cb35277236563d710bbea12860ba0d7a858cb74e31ffae829a9786224f8d8ac4d4d99f2ebb1a0612680c7243f7c69fe9

    • SSDEEP

      3072:ZBWePozVRNzRMMTTpN28eNuvOkkFPl88bu28f:ZBNQ1PTH2FNDJ2Eu2s

    Score
    8/10
    evasionpersistence

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks