Overview

overview

10

Static

static

10

34d47457be...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    34d47457bedbab6c6ff38be86e80ff7f9aa97d799b97a7ad9a9e81bb4d2569e7.exe
  • Size 75KB
  • Sample250914-xr9ssseq2y
  • SHA256 34d47457bedbab6c6ff38be86e80ff7f9aa97d799b97a7ad9a9e81bb4d2569e7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dacicdefaultdefense_evasionexecutionpersistencetrojan

Malware Config

Extracted

Family

  • dacic

Version

  • v3.6

Campaign

  • Default

C2

  • 127.0.0.1:8848

  • 127.0.0.1:2323

  • 127.0.0.1:42414

  • his-magnitude.gl.at.ply.gg:8848

  • his-magnitude.gl.at.ply.gg:2323

  • his-magnitude.gl.at.ply.gg:42414

Mutex

  • piwdiojikylehvkl

Attributes
  • anti

    false

  • anti_process

    true

  • anti_process_mode

    false

  • bsod

    false

  • bypass

    true

  • file_hide

    false

  • folder_hide

    false

  • get_admins

    true

  • get_system

    true

  • hkcu

    false

  • hklm

    false

  • hwid

    piwdiojikylehvkl

  • install

    true

  • node32

    false

  • pastebin

    null

  • server_file

    SysWOW64\winlanopen.exe

  • server_folder

    windir

  • startup

    false

  • task_sheduler_for_server_autorun

    false

  • task_sheduler_for_server_shedule

    true

  • task_sheduler_for_server_shedule_name

    Discord update

  • task_sheduler_for_watchdog_shedule

    false

  • task_sheduler_for_watchdog_shedule_name

    Windows Defender

  • user_init

    true

  • watchdog

    false

  • watchdog_file

    Intel\Games\Common\Commonuodate.exe

  • watchdog_folder

    appdatalocal

Targets

    • Target
      34d47457bedbab6c6ff38be86e80ff7f9aa97d799b97a7ad9a9e81bb4d2569e7.exe
    • Size 75KB
    • SHA256 34d47457bedbab6c6ff38be86e80ff7f9aa97d799b97a7ad9a9e81bb4d2569e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionexecutionpersistencetrojan
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks