2d1a78155a04aa5de4ff7df1c8fcf2ab68018c0393dff9073b591108d6976d1b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d1a78155a04aa5de4ff7df1c8fcf2ab68018c0393dff9073b591108d6976d1bN
Size

514KB
Sample

241009-avsmcstekl
MD5

17db37f7d173785f89d7e60b0c0e29a0
SHA1

6696317e13f1ac1f5a2094b1498e9f63b0fbf729
SHA256

2d1a78155a04aa5de4ff7df1c8fcf2ab68018c0393dff9073b591108d6976d1b
SHA512

51cf8903afb46eeed1a6d48eb071973b3ed7b3cc1e914ad42aec3a1239afe9b1fa9f7af054146d41c6ce79907cf3d3fd022146ab56522b1cbfffd365c0d07115
SSDEEP

6144:st9sTEckQEgdfHvkqFyMdFkuR7lQl/4sYdXj98:s6D3dfMqsMdOuRJQYX58

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  2d1a78155a04aa5de4ff7df1c8fcf2ab68018c0393dff9073b591108d6976d1bN
- Size
  
  514KB
- MD5
  
  17db37f7d173785f89d7e60b0c0e29a0
- SHA1
  
  6696317e13f1ac1f5a2094b1498e9f63b0fbf729
- SHA256
  
  2d1a78155a04aa5de4ff7df1c8fcf2ab68018c0393dff9073b591108d6976d1b
- SHA512
  
  51cf8903afb46eeed1a6d48eb071973b3ed7b3cc1e914ad42aec3a1239afe9b1fa9f7af054146d41c6ce79907cf3d3fd022146ab56522b1cbfffd365c0d07115
- SSDEEP
  
  6144:st9sTEckQEgdfHvkqFyMdFkuR7lQl/4sYdXj98:s6D3dfMqsMdOuRJQYX58
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence