Overview

overview

10

Static

static

3

4fc650ca6f...0N.exe

windows7-x64

4

4fc650ca6f...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4fc650ca6f44d97bd03a1c2f1ef1c010N.exe

  • Size

    8.0MB

  • Sample

    240915-a9mdwsxakr

  • MD5

    4fc650ca6f44d97bd03a1c2f1ef1c010

  • SHA1

    b1f53f84b79af747f04aac66b7fab7ab56f1dbf2

  • SHA256

    1f29ce0eb6cd08fe49d8322cf4adce63e86d753e82e1ae9afdc438c6dbcef79e

  • SHA512

    9acfcc7e0972f2b5d09aaacd68c77b58d2834777d011aab5f089e90f11c0f713d1e9ea0cd6a8b87df2f95a7e6c25c4d00c84f14cd10b2aed2979e932db72a39e

  • SSDEEP

    98304:VHdOZoRoiGYXAQ/ol9z01ivu8ZNooA52QhF4hWEw11iYRrlykS1SRY3g6ZYPt5ou:iitGUAQ/fUvuTg/CB51Rw7Qrf2TE

Score
10/10
discoveryexecutionpersistencepyinstaller

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://s3.amazonaws.com/cdn.hotglue.xyz/executables/nssm.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://s3.amazonaws.com/cdn.hotglue.xyz/executables/Sage50-HGConnector-v3.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://s3.amazonaws.com/cdn.hotglue.xyz/executables/Sage50-HGConnector-write-v29-v2.exe

Targets

    • Target

      4fc650ca6f44d97bd03a1c2f1ef1c010N.exe

    • Size

      8.0MB

    • MD5

      4fc650ca6f44d97bd03a1c2f1ef1c010

    • SHA1

      b1f53f84b79af747f04aac66b7fab7ab56f1dbf2

    • SHA256

      1f29ce0eb6cd08fe49d8322cf4adce63e86d753e82e1ae9afdc438c6dbcef79e

    • SHA512

      9acfcc7e0972f2b5d09aaacd68c77b58d2834777d011aab5f089e90f11c0f713d1e9ea0cd6a8b87df2f95a7e6c25c4d00c84f14cd10b2aed2979e932db72a39e

    • SSDEEP

      98304:VHdOZoRoiGYXAQ/ol9z01ivu8ZNooA52QhF4hWEw11iYRrlykS1SRY3g6ZYPt5ou:iitGUAQ/fUvuTg/CB51Rw7Qrf2TE

    Score
    10/10
    discoveryexecutionpersistencepyinstaller

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks