Overview

overview

8

Static

static

3

3.exe

windows7-x64

8

3.exe

windows10-2004-x64

8

$PLUGINSDI...ge.dll

windows7-x64

1

$PLUGINSDI...ge.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    3.exe

  • Size

    804KB

  • Sample

    240607-m6vmbafb9z

  • MD5

    cd7b7957361fccb2ca14ca9f418d84dd

  • SHA1

    fc26816adb2539b4994cece2d8fb64cb597e93e2

  • SHA256

    dd2d5f3f85924ec11cbd69da21bd0b25c5c8034aad3d9490c96e39f20b966d4f

  • SHA512

    d1ce9d1000e9000e1fd22455f90ed4f5f145a3796085855d78d6f9dd5359fde9cf23829665102487096ca7297189a31a498345e232846a5085b78470f29ff254

  • SSDEEP

    12288:nY4e3nd13Ic3+qGBIhP8PBujhleocbosx8:je3nYcudZPojhl5c0c8

Score
8/10
execution

Malware Config

Targets

    • Target

      3.exe

    • Size

      804KB

    • MD5

      cd7b7957361fccb2ca14ca9f418d84dd

    • SHA1

      fc26816adb2539b4994cece2d8fb64cb597e93e2

    • SHA256

      dd2d5f3f85924ec11cbd69da21bd0b25c5c8034aad3d9490c96e39f20b966d4f

    • SHA512

      d1ce9d1000e9000e1fd22455f90ed4f5f145a3796085855d78d6f9dd5359fde9cf23829665102487096ca7297189a31a498345e232846a5085b78470f29ff254

    • SSDEEP

      12288:nY4e3nd13Ic3+qGBIhP8PBujhleocbosx8:je3nYcudZPojhl5c0c8

    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/BgImage.dll

    • Size

      7KB

    • MD5

      ee255bdf426349e1caa8f1b71de9fd22

    • SHA1

      d589773826620046df1d77dd148f819a88dd35ec

    • SHA256

      a45f294137e2b0f6092eee8fdd2e19334f34ff3640d865a810b70f2104e92c21

    • SHA512

      71eeb41b5816b7d0f9517264aaf026da878561b6a222064c8100e47c383de9ac369800b734468322f3a6fc3eedb1a23d3c5ca6874bd7bf84af08f395248872cc

    • SSDEEP

      96:8ePik1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTc4j7J3kWyy/:tPdTJa2roqJyA2EN8diuTJje

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      dbdbf4017ff91c9de328697b5fd2e10a

    • SHA1

      b597a5e9a8a0b252770933feed51169b5060a09f

    • SHA256

      be60a00f32924ccbe03f9914e33b8e1ad8c8a1ca442263a69896efba74925b36

    • SHA512

      3befc15aab0a5dbe7fde96155b0499d385f2799b1a2d47ce04f37b5804006b1c6c4fff93d3cedb56a2a8172b23752b6f9dc6168cfce3596b91def3247836cf10

    • SSDEEP

      96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks