Overview

overview

10

Static

static

10

60c73b767a...3e.exe

windows10-2004-x64

10

60c73b767a...3e.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
  • Size 75KB
  • Sample250731-syetsawvcs
  • SHA256 60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dacicdefaultdefense_evasionexecutionpersistencetrojan

Malware Config

Extracted

Family

  • dacic

Version

  • v3.6

Campaign

  • Default

C2

  • better-starts.gl.at.ply.gg:31982

Mutex

  • mxcqrtvoxiwzyaiv

Attributes
  • anti

    false

  • anti_process

    true

  • anti_process_mode

    false

  • bsod

    true

  • bypass

    false

  • file_hide

    true

  • folder_hide

    true

  • get_admins

    true

  • get_system

    true

  • hkcu

    false

  • hkcu_name

    MicrosoftEdgeUpdateMachineCore

  • hklm

    false

  • hklm_name

    MicrosoftEdgeUpdateMachineCore

  • hwid

    mxcqrtvoxiwzyaiv

  • install

    true

  • node32

    false

  • node32_name

    MicrosoftEdgeUpdateMachineCore

  • pastebin

    null

  • server_file

    System32\Wincall.exe

  • server_folder

    windir

  • startup

    false

  • startup_name

    MicrosoftEdgeUpdateMachineCore

  • task_sheduler_for_server_autorun

    true

  • task_sheduler_for_server_autorun_name

    MicrosoftEdgeUpdateMachineCore

  • task_sheduler_for_server_shedule

    true

  • task_sheduler_for_server_shedule_name

    Discord update

  • task_sheduler_for_watchdog_shedule

    true

  • task_sheduler_for_watchdog_shedule_name

    Google common update

  • user_init

    true

  • watchdog

    true

  • watchdog_file

    Intel\Games\Common\Commonuodate.exe

  • watchdog_folder

    appdatalocal

Targets

    • Target
      60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
    • Size 75KB
    • SHA256 60c73b767a7c748be246b9c8edf19922e361f961fde414cdaa20f05933ef983e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionexecutionpersistencetrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks