9a2654d8c663913c10d767185a00137c3a3084612734275d5e3c4b861a6a9ccc

Sharing

Copy URL Twitter E-mail

General

Target
9a2654d8c663913c10d767185a00137c3a3084612734275d5e3c4b861a6a9ccc
Size 199KB
Sample260721-yv4avstdnh
SHA256 9a2654d8c663913c10d767185a00137c3a3084612734275d5e3c4b861a6a9ccc
MD5 b4e43b7ccf83d826d5655f482606f709
SHA1 9228903f9cfce9e202442ea8e1e4a97f8a005e23
SHA512 3ca0a10c8753be62317c4073f917d700559c91260c6d00d94528850bb71b1ee2a67493bb125e6c06bb4d6947c9f83363ef5776184c3f886d2dac5543770ab9b3
SSDEEP 6144:BKZ5do2WV/v1T27xQ5k07gU0/AaIF1AWVWy:BwuVFT27ok07Qg1FVWy
TLSH
T1A914231A93BDECE513155D5CA2C6F0AF863CEAD687B92C241A4B8F70F1A7BF05048176
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Orden de compra 67321.exe
- Size 296KB
- SHA256 f0f8c5389c9639798e99825b0ef038868c6170d7225d7fd7509cb8a246fb411b
- MD5 411ba5fe7a02e876911a832fe105657d
- SHA1 bf3b34479b707b5653f521e4ad68cde6eee4723d
- SHA512 d184942822715d9480acf3115822c496ff987deb599ad6e6d62d45ee3a5106f1edad33da81abc4242694be3fa604ced2a40c5d2f30933d2b7e0b867aa1bd5b3b
- SSDEEP 6144:Uh0sesiM+Hz5+LykB61h1sME7Sec9S1pLNCQwsFieYznM:lsiM+Hz5+LyhsuS1OQwGief
- TLSH
  T173547C1B3A899E35C8E0A97E38D77EB4B7D3EBFC254446C2210A67063831B5116DE739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
- MD5 81e268e27dbbcadbf116b5a9402195ab
- SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
- SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
- TLSH
  T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
- MD5 3fbd78c889fa40a2e5567b980c57b7db
- SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
- SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
- SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
- TLSH
  T1371207135A0044B3D9E2223A31AA2F2ED73C932490527D02C777DE5A2BB43166D3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
- MD5 13bd8e89dc79004d85ab02626e08c3c5
- SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
- SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
- SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
- TLSH
  T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8