Overview

overview

6

Static

static

1

msodbcsql_...26.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    msodbcsql_3be4cf889ad6c6334b15ac136d57321cbca28026.exe

  • Size

    4.1MB

  • Sample

    240410-spzslacf38

  • MD5

    ac85224e7442d03afab8e7e468d12b12

  • SHA1

    3be4cf889ad6c6334b15ac136d57321cbca28026

  • SHA256

    139bf4bc1e0b8b3832e82f23cef43ab0b66530caa0963e45950175df459b1458

  • SHA512

    607405c83eeac87239e9906092732a808deb16d4620ac46708f0b0efe15e097a66869e97ac6d78bcbe0f48a9ec30cfaf4a44c74ab8c35e95dd75e09ba39140d7

  • SSDEEP

    98304:tJxJzqAgBeiY7reD2RZDwEZbRmckDZVRss+C26lbZ8nHezBbH8YD:tJxwAn3e6RZhbUcif26sn+9bRD

Score
6/10
persistence

Malware Config

Targets

    • Target

      msodbcsql_3be4cf889ad6c6334b15ac136d57321cbca28026.exe

    • Size

      4.1MB

    • MD5

      ac85224e7442d03afab8e7e468d12b12

    • SHA1

      3be4cf889ad6c6334b15ac136d57321cbca28026

    • SHA256

      139bf4bc1e0b8b3832e82f23cef43ab0b66530caa0963e45950175df459b1458

    • SHA512

      607405c83eeac87239e9906092732a808deb16d4620ac46708f0b0efe15e097a66869e97ac6d78bcbe0f48a9ec30cfaf4a44c74ab8c35e95dd75e09ba39140d7

    • SSDEEP

      98304:tJxJzqAgBeiY7reD2RZDwEZbRmckDZVRss+C26lbZ8nHezBbH8YD:tJxwAn3e6RZhbUcif26sn+9bRD

    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks