0caf1f726585dcd30b0f09aa9a940377014c736d8bc631132a926965f7b23f69

Target

4f17e0e8d7f6931d86bcef776619a2b5.bin
Size

1.8MB
Sample

240412-r7mqbabc97
MD5

56273c482778adf274d434850971a465
SHA1

f4bf0c63a8d905c6a25b24dcf7b69b1a20504b98
SHA256

0caf1f726585dcd30b0f09aa9a940377014c736d8bc631132a926965f7b23f69
SHA512

d75f1c140f00054f42caa3f3d252da96db901fb5787169f806359c4ef70339fb39c0b30b04c5f81a74e2628d2776f5a9c7d7c2252c076d980fdd519b21d38902
SSDEEP

49152:Q02JCPLE3zfCFwF1ulDh8rG7LQIrgheinn85ye:QLUPwD6ICDi8cCghjn85d

Score

7^/10

Malware Config

Targets

- Target
  
  92f3c06a0ba8bc92f1a39521ad2979b86ce409fe9892e5f578e23a48fd8aef46.exe
- Size
  
  1.9MB
- MD5
  
  4f17e0e8d7f6931d86bcef776619a2b5
- SHA1
  
  0bb4fd9f5b2ab83b6dee04480b8e48a5f72b47fb
- SHA256
  
  92f3c06a0ba8bc92f1a39521ad2979b86ce409fe9892e5f578e23a48fd8aef46
- SHA512
  
  c461bd3a83f0520ac7dab22746d01397faba062efcab8d5df2a0a12a6834bf03a3f3efd18b7e419033eb10cb5372a792be19ce4000177d6543c7965e74367a4d
- SSDEEP
  
  49152:lu1Cicgvix2ooeL/DIk40DHN1Bl7BclwqyW:lusGIUeLhzxRyBv
Score

7^/10

persistence upx discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

UPX packed file

Adds Run key to start application

Creates a large amount of network flows

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4