Overview

overview

10

Static

static

3

d4e965deaa...ad.exe

windows7-x64

10

d4e965deaa...ad.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d4e965deaaaa9d84359fbce89a2cb1966bca6bf525df8bbfb1ad9ed08df1daad.exe

  • Size

    11.5MB

  • Sample

    240728-b3b51s1blk

  • MD5

    190e4ed7759276e78d16398673996b2b

  • SHA1

    ce5bb936ab809356d5b0bc29b6be2e0d07d3dc0a

  • SHA256

    d4e965deaaaa9d84359fbce89a2cb1966bca6bf525df8bbfb1ad9ed08df1daad

  • SHA512

    99cf79aba0afc528341c3ef474ba4ab71e50faf497536e74f8d985c39e85d5e145fb86262bac3e95e4c7752c3c0294751d4a988c2f4fbe5bcfcd3c6d19ef9c70

  • SSDEEP

    49152:h3FUhq8uEA5Cu+Ng9hxWpZdESPzNHk8aPu9ipJY0/CcjaChdReYEk8fSj+TBmkOv://CvGkk+8qc8On18iiDoA1PdxGdQI

Score
10/10
discoveryevasionexecutionpersistence

Malware Config

Targets

    • Target

      d4e965deaaaa9d84359fbce89a2cb1966bca6bf525df8bbfb1ad9ed08df1daad.exe

    • Size

      11.5MB

    • MD5

      190e4ed7759276e78d16398673996b2b

    • SHA1

      ce5bb936ab809356d5b0bc29b6be2e0d07d3dc0a

    • SHA256

      d4e965deaaaa9d84359fbce89a2cb1966bca6bf525df8bbfb1ad9ed08df1daad

    • SHA512

      99cf79aba0afc528341c3ef474ba4ab71e50faf497536e74f8d985c39e85d5e145fb86262bac3e95e4c7752c3c0294751d4a988c2f4fbe5bcfcd3c6d19ef9c70

    • SSDEEP

      49152:h3FUhq8uEA5Cu+Ng9hxWpZdESPzNHk8aPu9ipJY0/CcjaChdReYEk8fSj+TBmkOv://CvGkk+8qc8On18iiDoA1PdxGdQI

    Score
    10/10
    discoveryevasionexecutionpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks