Overview

overview

8

Static

static

3

987da2feba...be.exe

windows7-x64

8

987da2feba...be.exe

windows10-2004-x64

8

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    987da2feba47f44c619720682eb25199eb13aa4dddd5759c37fa943c569d30be.exe

  • Size

    456KB

  • Sample

    240523-b7xmhshc3x

  • MD5

    6d84fe81c98c02205cc129f68aca4529

  • SHA1

    cf805bfa98d12c72a2f355cf1743de9ca7b8d12c

  • SHA256

    987da2feba47f44c619720682eb25199eb13aa4dddd5759c37fa943c569d30be

  • SHA512

    cae0bb8a0297d54f5f9db2c7361f5fba9e8032e2bad91573ff9d83af3d87c86a483aff4afb0621cfc9dd744612bcdadf3ae315ed031c77adc342d0b447310009

  • SSDEEP

    6144:9qjI9UE2ypwdlL93DrhArk3l2fd55p5uhI5o8NUN6SYUiIdCcFSaKImLxUIohqy:UM2yKjL1mrnJpu0c6SDUH9UIohqy

Score
8/10
execution

Malware Config

Targets

    • Target

      987da2feba47f44c619720682eb25199eb13aa4dddd5759c37fa943c569d30be.exe

    • Size

      456KB

    • MD5

      6d84fe81c98c02205cc129f68aca4529

    • SHA1

      cf805bfa98d12c72a2f355cf1743de9ca7b8d12c

    • SHA256

      987da2feba47f44c619720682eb25199eb13aa4dddd5759c37fa943c569d30be

    • SHA512

      cae0bb8a0297d54f5f9db2c7361f5fba9e8032e2bad91573ff9d83af3d87c86a483aff4afb0621cfc9dd744612bcdadf3ae315ed031c77adc342d0b447310009

    • SSDEEP

      6144:9qjI9UE2ypwdlL93DrhArk3l2fd55p5uhI5o8NUN6SYUiIdCcFSaKImLxUIohqy:UM2yKjL1mrnJpu0c6SDUH9UIohqy

    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ac0f93b2dec82e9579bff14c8572a6c8

    • SHA1

      6460244317cbb77e342adb3561ec3acb496c84d5

    • SHA256

      3aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34

    • SHA512

      8055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2

    • SSDEEP

      96:5OBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+u3wEX:5hB2flXAVJtjf6cBbcB/N8Ved0PJ

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks