General

  • Target

    a41339abaddb69089a4fbba54fc00769c123de025a1507d0130a3203fb5d0834.exe

  • Size

    488KB

  • Sample

    240603-p6cgvage92

  • MD5

    806a9b20a38e7975e51a48f754515868

  • SHA1

    6a25e71039489abc73306178e9152e552e2446ab

  • SHA256

    a41339abaddb69089a4fbba54fc00769c123de025a1507d0130a3203fb5d0834

  • SHA512

    40625b245e5b512942380a1b53b601d34c80f536619bd789d1045ce810f17c866fcf94d8ca636dfbb1c0b0183f66dc38793cf6ff435505261bac4f78399cc2ec

  • SSDEEP

    12288:SkBMrvi8Xa6JdfM0CBCFDrV0ss52Be7hzExfSq11j82nt:FBMrhPRCuD5/srhzEFBj8c

Score
7/10

Malware Config

Targets

    • Target

      a41339abaddb69089a4fbba54fc00769c123de025a1507d0130a3203fb5d0834.exe

    • Size

      488KB

    • MD5

      806a9b20a38e7975e51a48f754515868

    • SHA1

      6a25e71039489abc73306178e9152e552e2446ab

    • SHA256

      a41339abaddb69089a4fbba54fc00769c123de025a1507d0130a3203fb5d0834

    • SHA512

      40625b245e5b512942380a1b53b601d34c80f536619bd789d1045ce810f17c866fcf94d8ca636dfbb1c0b0183f66dc38793cf6ff435505261bac4f78399cc2ec

    • SSDEEP

      12288:SkBMrvi8Xa6JdfM0CBCFDrV0ss52Be7hzExfSq11j82nt:FBMrhPRCuD5/srhzEFBj8c

    Score
    7/10
    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      9625d5b1754bc4ff29281d415d27a0fd

    • SHA1

      80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

    • SHA256

      c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

    • SHA512

      dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

    • SSDEEP

      192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks