c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b

General

Target
watchdog.exe
Size 11.9MB
Sample260722-arxf5sbm7v
SHA256 c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b
MD5 d1d04fba3118f1bf7296091926e151af
SHA1 53046358f4f81fdadb04f13d347500ada1e2b0ce
SHA512 63a8df6866ed4c2f503247020d0b83c7492f672a8bfc10f5af998962d44a8da33252333f7953f5e04d99480525c44c99a22ae151b6a511e14d5a94938347e03b
SSDEEP 196608:5ctokh/f+2W+t2PKMmjdV6kh1DvgKaZca1pgyhMkMgQvK3ehQeH2dCkBtp88cWt9:5cHjW+tHjdl15LyFQvK3eaeKBpVtd
TLSH
T1EFC633A4F26409FBF5E7003DC652A43A7777B9220F71C59F03B499A12E637E19936B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  watchdog.exe
- Size 11.9MB
- SHA256 c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b
- MD5 d1d04fba3118f1bf7296091926e151af
- SHA1 53046358f4f81fdadb04f13d347500ada1e2b0ce
- SHA512 63a8df6866ed4c2f503247020d0b83c7492f672a8bfc10f5af998962d44a8da33252333f7953f5e04d99480525c44c99a22ae151b6a511e14d5a94938347e03b
- SSDEEP 196608:5ctokh/f+2W+t2PKMmjdV6kh1DvgKaZca1pgyhMkMgQvK3ehQeH2dCkBtp88cWt9:5cHjW+tHjdl15LyFQvK3eaeKBpVtd
- TLSH
  T1EFC633A4F26409FBF5E7003DC652A43A7777B9220F71C59F03B499A12E637E19936B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution pyinstaller
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2