General

  • Target

    ee169d671b6a6152317cc7aa268f3a255fdcfd169c2470e1b49d251aebf9baea.exe

  • Size

    2.3MB

  • Sample

    241111-p54jyayma1

  • MD5

    1c9d68692165ffc847d60c8eb6f23818

  • SHA1

    f1541fd59895d8bfa1c86fd54258df2ba09bc1cb

  • SHA256

    ee169d671b6a6152317cc7aa268f3a255fdcfd169c2470e1b49d251aebf9baea

  • SHA512

    d36b352793ec763d9cbc9b58486ca78c59a6ed7ed48cfc10d9c6a7fb3fec29a8739d6ada30faef6f73ef58e06f845d0d3dc960231265f778d6a5412534d99ef4

  • SSDEEP

    49152:6jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNey:6rkI9rSjA5aDo73pzF2bz3p9y4HgIooq

Malware Config

Targets

    • Target

      ee169d671b6a6152317cc7aa268f3a255fdcfd169c2470e1b49d251aebf9baea.exe

    • Size

      2.3MB

    • MD5

      1c9d68692165ffc847d60c8eb6f23818

    • SHA1

      f1541fd59895d8bfa1c86fd54258df2ba09bc1cb

    • SHA256

      ee169d671b6a6152317cc7aa268f3a255fdcfd169c2470e1b49d251aebf9baea

    • SHA512

      d36b352793ec763d9cbc9b58486ca78c59a6ed7ed48cfc10d9c6a7fb3fec29a8739d6ada30faef6f73ef58e06f845d0d3dc960231265f778d6a5412534d99ef4

    • SSDEEP

      49152:6jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNey:6rkI9rSjA5aDo73pzF2bz3p9y4HgIooq

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks