Overview

overview

10

Static

static

10

4af4b08590...49.exe

windows10-2004-x64

10

4af4b08590...49.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4af4b08590a68731ca610be59acbb7d3e176bd33d491476187e25a899c8e9049
  • Size 75KB
  • Sample250731-syetsaykt5
  • SHA256 4af4b08590a68731ca610be59acbb7d3e176bd33d491476187e25a899c8e9049
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dacicdefaultdefense_evasionexecutionpersistencetrojan

Malware Config

Extracted

Family

  • dacic

Version

  • v3.6

Campaign

  • Default

C2

  • control-road.gl.at.ply.gg:32384

Mutex

  • mrdmhqfambo

Attributes
  • anti

    false

  • anti_process

    false

  • anti_process_mode

    false

  • bsod

    true

  • bypass

    true

  • file_hide

    true

  • folder_hide

    true

  • get_admins

    true

  • get_system

    true

  • hkcu

    true

  • hkcu_name

    User Experience Host

  • hklm

    true

  • hklm_name

    Windows Management Service

  • hwid

    mrdmhqfambo

  • install

    true

  • node32

    true

  • node32_name

    Security Monitor

  • pastebin

    null

  • server_file

    Web/WebRT/Web.exe

  • server_folder

    windir

  • startup

    false

  • task_sheduler_for_server_autorun

    true

  • task_sheduler_for_server_autorun_name

    Background Scheduler

  • task_sheduler_for_server_shedule

    true

  • task_sheduler_for_server_shedule_name

    Background Scheduler

  • task_sheduler_for_watchdog_shedule

    true

  • task_sheduler_for_watchdog_shedule_name

    Service Scheduler

  • user_init

    true

  • watchdog

    true

  • watchdog_file

    vss/writes/winlogon.exe

  • watchdog_folder

    windir

Targets

    • Target
      4af4b08590a68731ca610be59acbb7d3e176bd33d491476187e25a899c8e9049
    • Size 75KB
    • SHA256 4af4b08590a68731ca610be59acbb7d3e176bd33d491476187e25a899c8e9049
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionexecutionpersistencetrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks