Overview

overview

9

Static

static

3

1623544e05...dd.exe

windows7-x64

9

1623544e05...dd.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1623544e05601c27ec7ef4413763e532f527526f838d227ba777480546f710dd

  • Size

    426KB

  • Sample

    240408-xmtk1sgh65

  • MD5

    c24b83c585cd7a3043c8081f1fd29d1c

  • SHA1

    5d5fc26a0f6bc7ad8b55abc71a79766c369d3741

  • SHA256

    1623544e05601c27ec7ef4413763e532f527526f838d227ba777480546f710dd

  • SHA512

    0c719a352eb1f4b90266a315f4d74d1cc65d7b4d449e0285decd8f1715539326d36a9c843832d0ad4cbd55a0747930157a1bcf278dfced6058e63d7433e24f65

  • SSDEEP

    6144:oquvgPnIN0Q/uBf5WR+KLBMQn4fNgj8ZYN3LifNg/CeV83:oqusIq8of5u+e/8Z44223

Score
9/10
persistence

Malware Config

Targets

    • Target

      1623544e05601c27ec7ef4413763e532f527526f838d227ba777480546f710dd

    • Size

      426KB

    • MD5

      c24b83c585cd7a3043c8081f1fd29d1c

    • SHA1

      5d5fc26a0f6bc7ad8b55abc71a79766c369d3741

    • SHA256

      1623544e05601c27ec7ef4413763e532f527526f838d227ba777480546f710dd

    • SHA512

      0c719a352eb1f4b90266a315f4d74d1cc65d7b4d449e0285decd8f1715539326d36a9c843832d0ad4cbd55a0747930157a1bcf278dfced6058e63d7433e24f65

    • SSDEEP

      6144:oquvgPnIN0Q/uBf5WR+KLBMQn4fNgj8ZYN3LifNg/CeV83:oqusIq8of5u+e/8Z44223

    Score
    9/10
    persistence

    • Detects executables (downlaoders) containing URLs to raw contents of a paste

    • Detects executables referencing many IR and analysis tools

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks