Overview

overview

10

Static

static

3

d5c0204c35...03.exe

windows7-x64

10

d5c0204c35...03.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5c0204c353df61ec441c834c56c4b03

  • Size

    243KB

  • Sample

    240319-k9c6bsgg4y

  • MD5

    d5c0204c353df61ec441c834c56c4b03

  • SHA1

    4df64a5b956fb7b67bb5489bd069b755cd535f2a

  • SHA256

    dffde103274f93ec565bc1f394c6b94bea9c0d0c7dc9283a5b61d9adba348eba

  • SHA512

    86aa77d0d8db09e16e6158606e67a1bff81b58ea7c9432104e508b888a0235f5b3959d16d17f99a2ffd8dcdbf57715f77ae51843b62e6c7aa9f052a14bdf0208

  • SSDEEP

    6144:Q0a3JZG91AD8A28YoJCoIahGg69dAAxg3gzN3:Q0UGYeOXh3eAAig5

Score
10/10
persistence

Malware Config

Targets

    • Target

      d5c0204c353df61ec441c834c56c4b03

    • Size

      243KB

    • MD5

      d5c0204c353df61ec441c834c56c4b03

    • SHA1

      4df64a5b956fb7b67bb5489bd069b755cd535f2a

    • SHA256

      dffde103274f93ec565bc1f394c6b94bea9c0d0c7dc9283a5b61d9adba348eba

    • SHA512

      86aa77d0d8db09e16e6158606e67a1bff81b58ea7c9432104e508b888a0235f5b3959d16d17f99a2ffd8dcdbf57715f77ae51843b62e6c7aa9f052a14bdf0208

    • SSDEEP

      6144:Q0a3JZG91AD8A28YoJCoIahGg69dAAxg3gzN3:Q0UGYeOXh3eAAig5

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks