Overview

overview

7

Static

static

3

53501f1226...1f.exe

windows7-x64

7

53501f1226...1f.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

  • Size

    573KB

  • Sample

    240523-bw4axsgh42

  • MD5

    b07b3994ad66a39937d9081eb64cd5f5

  • SHA1

    3fffe0fb2721f440909f99c5cb74d1d556ac45bb

  • SHA256

    53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f

  • SHA512

    43c7d08528c57467054c69c7d2b007662f618604abb465d92b1118dff290d0cb0bc8b2458ef35ae93fbc4d4b2f5527c298c350fc7743a21eacd548bd5f02d6e5

  • SSDEEP

    6144:KcBvWsKG0/FZuK1JnKr4AlEhZmqUH1o0TLIaGWDwiyPAw9RyJqIZRSNQABuX+rVy:nKFZ1exehZmNHKyrwLpaJlZrf+r0

Score
7/10

Malware Config

Targets

    • Target

      53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

    • Size

      573KB

    • MD5

      b07b3994ad66a39937d9081eb64cd5f5

    • SHA1

      3fffe0fb2721f440909f99c5cb74d1d556ac45bb

    • SHA256

      53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f

    • SHA512

      43c7d08528c57467054c69c7d2b007662f618604abb465d92b1118dff290d0cb0bc8b2458ef35ae93fbc4d4b2f5527c298c350fc7743a21eacd548bd5f02d6e5

    • SSDEEP

      6144:KcBvWsKG0/FZuK1JnKr4AlEhZmqUH1o0TLIaGWDwiyPAw9RyJqIZRSNQABuX+rVy:nKFZ1exehZmNHKyrwLpaJlZrf+r0

    Score
    7/10

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      12b140583e3273ee1f65016becea58c4

    • SHA1

      92df24d11797fefd2e1f8d29be9dfd67c56c1ada

    • SHA256

      014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

    • SHA512

      49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

    • SSDEEP

      192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks