Overview

overview

10

Static

static

3

8e3c8a6712...f2.exe

windows7-x64

10

8e3c8a6712...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

  • Size

    8.9MB

  • Sample

    240822-ccs7aawfkn

  • MD5

    6e1f77d96601fc0e931fd355faaa373f

  • SHA1

    a85772631a0c6d86c134c27e69fb19a433aa1729

  • SHA256

    8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2

  • SHA512

    defe1efd09e3ae0251382d9df051817fbcbbe9b6a6d4091537e05da7cf145b8b00fe2736f895a5a6b2fff0fb0c3e84882e90a62e096af5db6d22932de6398c11

  • SSDEEP

    98304:pL6VwkcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:EcepY3EDhKRuJZYYE1H/0zRS

Score
10/10
sliverbackdoordefense_evasiondiscoveryevasionexecutiontrojan

Malware Config

Targets

    • Target

      8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

    • Size

      8.9MB

    • MD5

      6e1f77d96601fc0e931fd355faaa373f

    • SHA1

      a85772631a0c6d86c134c27e69fb19a433aa1729

    • SHA256

      8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2

    • SHA512

      defe1efd09e3ae0251382d9df051817fbcbbe9b6a6d4091537e05da7cf145b8b00fe2736f895a5a6b2fff0fb0c3e84882e90a62e096af5db6d22932de6398c11

    • SSDEEP

      98304:pL6VwkcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:EcepY3EDhKRuJZYYE1H/0zRS

    Score
    10/10
    discoveryevasionexecutionsliverbackdoordefense_evasiontrojan

    • Modifies security service

      evasion

    • Sliver RAT v2

    • SliverRAT

      SliverRAT is an open source Adversary Emulation Framework.

      trojanbackdoorsliver

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Looks for VMWare Tools registry key

      evasion

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks