14cb7059b0ee3385a51bc4010a4bda20326368ac9270c866abe850db445fb3c3

General

Target
14cb7059b0ee3385a51bc4010a4bda20326368ac9270c866abe850db445fb3c3
Size 3.5MB
Sample260708-eswnfsaw31
SHA256 14cb7059b0ee3385a51bc4010a4bda20326368ac9270c866abe850db445fb3c3
MD5 75994575a32a2c36ccf2947605e7fa19
SHA1 05a32792b53d273cb13b99022f188c1f64784dd4
SHA512 851a4f3086ca38ee299c44e80f338b209193eaf9e2ceec78dade0364398df7831ad43c4f6425973399e221132f0c2d0f78185b8b2a2d12d7f676d1f93d6e82a9
SSDEEP 98304:YLOeIms/V/nzQ+zLOeIms/V/nzQ+HLOeIms/V/nzQ+S:YSxkQSxkySxkj
TLSH
T1AE0633D110F24ABB49097D0A6EC1BBD162567F4A11202F3716A7CF3EBCA4B99307A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Targets

- Target
  chrome-updater.exe
- Size 2.3MB
- SHA256 198ae0c27cba600ea6f49fe8f125e342c7b2c80c36aca4b89e0ab526769c3adf
- MD5 40231a684124c4eaf8724b852dd87dec
- SHA1 7449ae2dbcb81acfbc6719b3cd831dfc8adc1ead
- SHA512 2489caa942ad2a249dcc064c284846467b84c76adea9d0230ae0bdcda87aeb1f1e82061be0eb2a0612d02b059e10e9314a01360a5b11594a405f9cbc12008762
- SSDEEP 49152:AqiyWdlh+fuGoh89lmrusedL6nsMsJIMSYIU6igS:AoF88DrDSn+T
- TLSH
  T143B57C03F69584EAC59AC078C3579633BA72B88E0730B6EB2BD04E213E66F905F1D755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  dart-host.exe
- Size 2.3MB
- SHA256 198ae0c27cba600ea6f49fe8f125e342c7b2c80c36aca4b89e0ab526769c3adf
- MD5 40231a684124c4eaf8724b852dd87dec
- SHA1 7449ae2dbcb81acfbc6719b3cd831dfc8adc1ead
- SHA512 2489caa942ad2a249dcc064c284846467b84c76adea9d0230ae0bdcda87aeb1f1e82061be0eb2a0612d02b059e10e9314a01360a5b11594a405f9cbc12008762
- SSDEEP 49152:AqiyWdlh+fuGoh89lmrusedL6nsMsJIMSYIU6igS:AoF88DrDSn+T
- TLSH
  T143B57C03F69584EAC59AC078C3579633BA72B88E0730B6EB2BD04E213E66F905F1D755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  zoom-service.exe
- Size 2.3MB
- SHA256 198ae0c27cba600ea6f49fe8f125e342c7b2c80c36aca4b89e0ab526769c3adf
- MD5 40231a684124c4eaf8724b852dd87dec
- SHA1 7449ae2dbcb81acfbc6719b3cd831dfc8adc1ead
- SHA512 2489caa942ad2a249dcc064c284846467b84c76adea9d0230ae0bdcda87aeb1f1e82061be0eb2a0612d02b059e10e9314a01360a5b11594a405f9cbc12008762
- SSDEEP 49152:AqiyWdlh+fuGoh89lmrusedL6nsMsJIMSYIU6igS:AoF88DrDSn+T
- TLSH
  T143B57C03F69584EAC59AC078C3579633BA72B88E0730B6EB2BD04E213E66F905F1D755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Executes dropped EXE

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6