252385d2f2b80fe7a02f557f08a022b18bce6e51810f2c5a04c55c4bf3d963ef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d768c2f5df0d4a31e0e062be74d4e43b
Size

241KB
Sample

240320-abf48abc75
MD5

d768c2f5df0d4a31e0e062be74d4e43b
SHA1

7c4660566893f1703223a91d3296785562bd1549
SHA256

252385d2f2b80fe7a02f557f08a022b18bce6e51810f2c5a04c55c4bf3d963ef
SHA512

319ec85399622f6a4630d5373cd933cd9572aaf1683d7cf9a1091f2059a42ab933532ec7662991cc4ecd962df799aae5a98bc89a7e1b65cc4abf4e156727fc79
SSDEEP

6144:KCHX8sfphlfZHOVf/FDmd6Ddc8fiF3B5+F8VAeRhRoh:7ssRVImd6RH6JBe6AeRhRoh

Score

7^/10

Malware Config

Targets

- Target
  
  d768c2f5df0d4a31e0e062be74d4e43b
- Size
  
  241KB
- MD5
  
  d768c2f5df0d4a31e0e062be74d4e43b
- SHA1
  
  7c4660566893f1703223a91d3296785562bd1549
- SHA256
  
  252385d2f2b80fe7a02f557f08a022b18bce6e51810f2c5a04c55c4bf3d963ef
- SHA512
  
  319ec85399622f6a4630d5373cd933cd9572aaf1683d7cf9a1091f2059a42ab933532ec7662991cc4ecd962df799aae5a98bc89a7e1b65cc4abf4e156727fc79
- SSDEEP
  
  6144:KCHX8sfphlfZHOVf/FDmd6Ddc8fiF3B5+F8VAeRhRoh:7ssRVImd6RH6JBe6AeRhRoh
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2