e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921

General

Target
e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921.exe
Size 475KB
Sample250310-nsffxatjs6
SHA256 e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921
MD5 ed8fb567b8dbdd912221f3b9668ebd22
SHA1 955348abd953e80ee7769975b7c75cc858986366
SHA512 338947b43dd6ff207ffb3131235ad8007be7bd631604b9aa8aac6f5ec9d32afa90fc4cee7f274c77081178df0334355abdac881f884c05c1d666e0b9c9367fe2
SSDEEP 12288:vQeEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2J/JSJFJ8JjJcJHJQJoXJSJAhwjJTJZe:jEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2m
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921.exe
- Size 475KB
- SHA256 e7a36fadad357adadb8a4135a3294fbb42de472adbb573c20fa7f7efc6c0e921
- MD5 ed8fb567b8dbdd912221f3b9668ebd22
- SHA1 955348abd953e80ee7769975b7c75cc858986366
- SHA512 338947b43dd6ff207ffb3131235ad8007be7bd631604b9aa8aac6f5ec9d32afa90fc4cee7f274c77081178df0334355abdac881f884c05c1d666e0b9c9367fe2
- SSDEEP 12288:vQeEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2J/JSJFJ8JjJcJHJQJoXJSJAhwjJTJZe:jEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2m
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution
- Loads dropped DLL
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f
- MD5 51e63a9c5d6d230ef1c421b2eccd45dc
- SHA1 c499cdad5c613d71ed3f7e93360f1bbc5748c45d
- SHA512 c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522
- SSDEEP 96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Krblings.Udp
- Size 52KB
- SHA256 9d73643cf485e0534e1cdf7c403fb1dfc1b369f3e0e5ffe0bce1fd2059b5e02b
- MD5 9837b7fc04059d1fd370965105f814a2
- SHA1 4bd4fb6d110d4b4ed57528dcc6ff1fcc973d9215
- SHA512 6b549ef5d4bb64c74a29725019a5d268fc83de4046e2222fcd0ee63c4472bbd4fb7b487b271808747ea50208764a42acd41882098f186e55f2e0084e63871e65
- SSDEEP 1536:cjm9OipO/0S70WFhbShNcAeaKYM19ZUO2zT2lu:c695E86/AlKYq9ncT2lu
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6