416a461ac67dafb491ea01c3586956ce39cf966f4d19082d669eae1752558ca3

General

Target
416a461ac67dafb491ea01c3586956ce39cf966f4d19082d669eae1752558ca3.exe
Size 467KB
Sample250310-ny5mzstvc1
SHA256 416a461ac67dafb491ea01c3586956ce39cf966f4d19082d669eae1752558ca3
MD5 a0d7ae5057d16b4881b59285364fbc6a
SHA1 5192f33fd6e86b445535c82d3ea42bf08370f2a8
SHA512 e26b622ac96aeb941a99c8ba4f7a1987caba24d7c19c44c8a4b8de115f14980831dff8b2af8ca08acc3e71637fb3378c600b101ce3d83e3ef81392a36a7a6a39
SSDEEP 12288:iQeEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2J/JSJFJ8JjJcJHJQJoXJSJAhwjJTJZx:MEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ25
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  416a461ac67dafb491ea01c3586956ce39cf966f4d19082d669eae1752558ca3.exe
- Size 467KB
- SHA256 416a461ac67dafb491ea01c3586956ce39cf966f4d19082d669eae1752558ca3
- MD5 a0d7ae5057d16b4881b59285364fbc6a
- SHA1 5192f33fd6e86b445535c82d3ea42bf08370f2a8
- SHA512 e26b622ac96aeb941a99c8ba4f7a1987caba24d7c19c44c8a4b8de115f14980831dff8b2af8ca08acc3e71637fb3378c600b101ce3d83e3ef81392a36a7a6a39
- SSDEEP 12288:iQeEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ2J/JSJFJ8JjJcJHJQJoXJSJAhwjJTJZx:MEJFJYJbJPeJyxJxWJiJfJcJWJSJaJ25
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution
- Loads dropped DLL
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f
- MD5 51e63a9c5d6d230ef1c421b2eccd45dc
- SHA1 c499cdad5c613d71ed3f7e93360f1bbc5748c45d
- SHA512 c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522
- SSDEEP 96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Entrench/Regarantiers.Ska
- Size 51KB
- SHA256 16720c870a42d88739fadbb6377934ab2b31d3b94287f5cae417c11f0f9178de
- MD5 89d68787cd0f4ee94faf084bae8d01ff
- SHA1 9503d4223742dfd7364f73d3345973210a4e429b
- SHA512 a83df36e18004a10ab7b4ddec66a6390f27b603ca93e3691909b7ce73bef7d79c7e4f1da7e2d67ee37caf32976b1fbe3fffa3957820a86d4279f0a8312af1f60
- SSDEEP 768:FKkdxh/tPIGIZ0ngMHFMughj+NaQFKuB1F5D7pAoGmQS7HBRHELKLCkz:Mkdxh1IhTUOF+Nac37+LFAhRkep
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6