Overview

overview

8

Static

static

1

Nimetön.png

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nimetön.png

  • Size

    377KB

  • Sample

    241204-rmyxvaxqex

  • MD5

    4c2277e1a08b1c3b1ca83aa803567f00

  • SHA1

    ee594a939a8a2e87656a18e9cb5fb219a6f438af

  • SHA256

    11a5d2b9427df09750e64419cba8eafacd714d030eb261c9e453cef888b5e1b5

  • SHA512

    b7bacc80eee66fc0f5a46dcf8dc426d2faf65437efc741b9844fa8460d476bedd0ccf00e620e91b88f083815fb156199173e8efee6679c1b0b8aaac0fb097d9d

  • SSDEEP

    6144:17XDPePgM42F4xRsYn6C/r3TsXaZUqg0StmhMJnV8AwnSVSq//VjazVVwPeKZvse:1H7DZzrnH3wXaZPgbmGJnVZ8Soq//Y0z

Score
8/10
discoverymotwpersistencephishing

Malware Config

Targets

    • Target

      Nimetön.png

    • Size

      377KB

    • MD5

      4c2277e1a08b1c3b1ca83aa803567f00

    • SHA1

      ee594a939a8a2e87656a18e9cb5fb219a6f438af

    • SHA256

      11a5d2b9427df09750e64419cba8eafacd714d030eb261c9e453cef888b5e1b5

    • SHA512

      b7bacc80eee66fc0f5a46dcf8dc426d2faf65437efc741b9844fa8460d476bedd0ccf00e620e91b88f083815fb156199173e8efee6679c1b0b8aaac0fb097d9d

    • SSDEEP

      6144:17XDPePgM42F4xRsYn6C/r3TsXaZUqg0StmhMJnV8AwnSVSq//VjazVVwPeKZvse:1H7DZzrnH3wXaZPgbmGJnVZ8Soq//Y0z

    Score
    8/10
    discoverymotwpersistencephishing

    • Downloads MZ/PE file

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks