267bdd0b21f44ccf8662c2e36e381dfb2aae3c8019a9d6099689fc9f49a90a56 | Triage

Sharing

General

Target

RFQ0046224635List2.Drawingimg1.exe
Size

948KB
Sample

250328-myc3asvvfz
MD5

52dba7fd749749bc6e2735cae904a26c
SHA1

f878524a0e8ad8ee94a1a70c81b75415435e5fdd
SHA256

267bdd0b21f44ccf8662c2e36e381dfb2aae3c8019a9d6099689fc9f49a90a56
SHA512

79ff7fd14ba7a6006856a3974f74ce39645eade87647b89c5dc35dc7b69035c19fa127a332da2085c5b0107d3a067f73a575df9054f6051c784fe5bbc618943f
SSDEEP

24576:Ru6J33O0c+JY5UZ+XC0kGso6Fas3d18WY:Du0c++OCvkGs9FasrY

Score

10^/10

collection defense_evasion discovery evasion trojan

Malware Config

Targets

- Target
  
  RFQ0046224635List2.Drawingimg1.exe
- Size
  
  948KB
- MD5
  
  52dba7fd749749bc6e2735cae904a26c
- SHA1
  
  f878524a0e8ad8ee94a1a70c81b75415435e5fdd
- SHA256
  
  267bdd0b21f44ccf8662c2e36e381dfb2aae3c8019a9d6099689fc9f49a90a56
- SHA512
  
  79ff7fd14ba7a6006856a3974f74ce39645eade87647b89c5dc35dc7b69035c19fa127a332da2085c5b0107d3a067f73a575df9054f6051c784fe5bbc618943f
- SSDEEP
  
  24576:Ru6J33O0c+JY5UZ+XC0kGso6Fas3d18WY:Du0c++OCvkGs9FasrY
Score

10^/10

collection defense_evasion discovery evasion trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Disables Task Manager via registry modification
  defense_evasion
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondefense_evasiondiscoveryevasiontrojan

behavioral2

collectiondefense_evasiondiscoveryevasiontrojan