Overview

overview

10

Static

static

3

c983dd7341...3N.exe

windows7-x64

10

c983dd7341...3N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c983dd7341ee70efcddc66491abfa5567c75d562d7990c876fd84dc3ec9dc163N

  • Size

    2.3MB

  • Sample

    241013-z6levsygpg

  • MD5

    42f31f98028cfe21c7d37450a4c07200

  • SHA1

    b2f96d230aef8e883e843e3f2f46d09855ccd996

  • SHA256

    c983dd7341ee70efcddc66491abfa5567c75d562d7990c876fd84dc3ec9dc163

  • SHA512

    a7b562a1b0941ff6d98e4bf01f2951d3f0c307ec3eaa0642a732a5acc841eb192214eaa754a81cc0481b1966dbf36da62fb1c52dca2aca39d36223be557fa235

  • SSDEEP

    49152:SLHEfWcnLJ6I3BUz8fsK5CdoQmTZMCpylljl:ZXnL73XHdFHpql

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      c983dd7341ee70efcddc66491abfa5567c75d562d7990c876fd84dc3ec9dc163N

    • Size

      2.3MB

    • MD5

      42f31f98028cfe21c7d37450a4c07200

    • SHA1

      b2f96d230aef8e883e843e3f2f46d09855ccd996

    • SHA256

      c983dd7341ee70efcddc66491abfa5567c75d562d7990c876fd84dc3ec9dc163

    • SHA512

      a7b562a1b0941ff6d98e4bf01f2951d3f0c307ec3eaa0642a732a5acc841eb192214eaa754a81cc0481b1966dbf36da62fb1c52dca2aca39d36223be557fa235

    • SSDEEP

      49152:SLHEfWcnLJ6I3BUz8fsK5CdoQmTZMCpylljl:ZXnL73XHdFHpql

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks