General

  • Target

    tmp.bin

  • Size

    551KB

  • Sample

    240522-crex7shd2z

  • MD5

    9de6a17e06aabbe4321c4f3aac95766e

  • SHA1

    396ade676745f08d6d347aaf10ceb5c04517382b

  • SHA256

    ea9021d898e70721926052ec5c1560dadd8950fcbab9c0656d054f6dd960e01e

  • SHA512

    61279221d0fedbea082aedc5dd8ec538bcf2189147389be6e1145667132955ea9a4cfb92268996ae8994cd9c59841a227f2588b8809d332944f1570e96233dc5

  • SSDEEP

    12288:QH7MMIqb9B3vYvGyXidl4ggn1N4MGKDit8UeplW8LmZq:k7a69B3gRkTgn1aMGKDi4lW8Lm8

Malware Config

Targets

    • Target

      tmp.bin

    • Size

      551KB

    • MD5

      9de6a17e06aabbe4321c4f3aac95766e

    • SHA1

      396ade676745f08d6d347aaf10ceb5c04517382b

    • SHA256

      ea9021d898e70721926052ec5c1560dadd8950fcbab9c0656d054f6dd960e01e

    • SHA512

      61279221d0fedbea082aedc5dd8ec538bcf2189147389be6e1145667132955ea9a4cfb92268996ae8994cd9c59841a227f2588b8809d332944f1570e96233dc5

    • SSDEEP

      12288:QH7MMIqb9B3vYvGyXidl4ggn1N4MGKDit8UeplW8LmZq:k7a69B3gRkTgn1aMGKDi4lW8Lm8

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1c8b2b40c642e8b5a5b3ff102796fb37

    • SHA1

      3245f55afac50f775eb53fd6d14abb7fe523393d

    • SHA256

      8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

    • SHA512

      4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

    • SSDEEP

      96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      09c2e27c626d6f33018b8a34d3d98cb6

    • SHA1

      8d6bf50218c8f201f06ecf98ca73b74752a2e453

    • SHA256

      114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1

    • SHA512

      883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954

    • SSDEEP

      96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks