Overview

overview

10

Static

static

3

c241b7dcd7...e8.exe

windows7-x64

6

c241b7dcd7...e8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1f94467a39c31fa50433f1f72b1eb876.bin

  • Size

    1.6MB

  • Sample

    240825-bdb4qazcme

  • MD5

    c85be0ebbabb745076f795eaa26cccf8

  • SHA1

    cf23393674feb40a685bbdb94ac88a6be809efee

  • SHA256

    365997331dd90baafe7e8830421c74bd8011e814981247fd50fb7375d1bd2b54

  • SHA512

    72c0ef6bcd8f57e5771f2f68ba3e320b0e9f9070dc10f0ba8f649798547194c42ef86c514604a7f01c1e6df673914ee5b78b1d65607d3def67392a6d7b976229

  • SSDEEP

    49152:ZWAooOsYvh7vvVdKuizTov1CZHTrMR37W:YAooOV71zizMv1CxTg1K

Score
10/10
collectiondiscoverypersistence

Malware Config

Targets

    • Target

      c241b7dcd7b17a18f64f830101aecc1269987ab3500c4277c72b90d5a65f1de8.exe

    • Size

      1.6MB

    • MD5

      1f94467a39c31fa50433f1f72b1eb876

    • SHA1

      8c9336a9c876c2d500f7dbc4703b2a5aaede8783

    • SHA256

      c241b7dcd7b17a18f64f830101aecc1269987ab3500c4277c72b90d5a65f1de8

    • SHA512

      129296de8cb787cbb09e5b15713b1f8591ed1c43751fd96c51952cb478be7d76563a5d32b0c805f94af93f0e17d87240b5e3f1f341f858974c72067b8b91102d

    • SSDEEP

      49152:keNufLEtJnvbob+Nxc+ygQDmDS0xY+mbiyc:k7T+nfjc+PDS0ZN

    Score
    10/10
    discoverypersistencecollection

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks