Overview

overview

10

Static

static

1

70cbb6ca45...a.xlam

windows7-x64

10

70cbb6ca45...a.xlam

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

  • Size

    611KB

  • Sample

    241021-z29a5axard

  • MD5

    33befe584a0a8e659e29c8ce5129f61f

  • SHA1

    32236fd8f2c9d1b62e4633c72bbe5c38107d56c8

  • SHA256

    70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

  • SHA512

    61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d

  • SSDEEP

    12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://drive.google.com/uc?export=download&id=1-Wdgeq0fX9aApdlSW9dln1Pc_KEGpfHp

exe.dropper

https://drive.google.com/uc?export=download&id=1-Wdgeq0fX9aApdlSW9dln1Pc_KEGpfHp

Targets

    • Target

      70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

    • Size

      611KB

    • MD5

      33befe584a0a8e659e29c8ce5129f61f

    • SHA1

      32236fd8f2c9d1b62e4633c72bbe5c38107d56c8

    • SHA256

      70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

    • SHA512

      61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d

    • SSDEEP

      12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

    Score
    10/10
    discoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks