Overview

overview

8

Static

static

3

b76461cc2c...0N.exe

windows7-x64

8

b76461cc2c...0N.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b76461cc2cd642f4dc9be8dd78eee130N.exe

  • Size

    704KB

  • Sample

    240806-re689a1dkl

  • MD5

    b76461cc2cd642f4dc9be8dd78eee130

  • SHA1

    3fd71ad4dfdc16daca1749fe7ab5e677cf3824ea

  • SHA256

    0fbe8246924efb4a2214b064cfda8cb98069aaee7af1e68311f941bc21c17190

  • SHA512

    d0556a4cfec0270a17537182a56b2744c5eed177ce66d91d3b85a4aedbc907ae29edc7c1818602060535164fdf4623d1ba4f3866d1981f625b8a2aa4b36cf1af

  • SSDEEP

    12288:3QwY/2067WhaCjx1wp70f1k6muIut8iqWrrckBsMtinswNvA3wpVU0gr:a6rc1wuf1kBuIuGiqyFtifFu

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      b76461cc2cd642f4dc9be8dd78eee130N.exe

    • Size

      704KB

    • MD5

      b76461cc2cd642f4dc9be8dd78eee130

    • SHA1

      3fd71ad4dfdc16daca1749fe7ab5e677cf3824ea

    • SHA256

      0fbe8246924efb4a2214b064cfda8cb98069aaee7af1e68311f941bc21c17190

    • SHA512

      d0556a4cfec0270a17537182a56b2744c5eed177ce66d91d3b85a4aedbc907ae29edc7c1818602060535164fdf4623d1ba4f3866d1981f625b8a2aa4b36cf1af

    • SSDEEP

      12288:3QwY/2067WhaCjx1wp70f1k6muIut8iqWrrckBsMtinswNvA3wpVU0gr:a6rc1wuf1kBuIuGiqyFtifFu

    Score
    8/10
    discoverypersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks