d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07

General

Target
d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
Size 649KB
Sample260810-rmqaps1ald
SHA256 d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07
MD5 1ec3ccb73ef98e16431612a7ad9f8900
SHA1 54d49c75f34cc832f08a553fd4c9663d61ee7531
SHA512 42747b0a30199e49737d5c9532667e3e0e7fd7513f24e61b12636ed3794ec9a4c80d69eb436d1bf972a34838dfe8ed8dba8d921ce70cce87a8adf4828e0de632
SSDEEP 12288:Jtg++Nmxxy6BhAEPrwaWkCQjSX/jr/c13aQRHWxOzJ8T6Ll6Cvy4fKSCci:JMNmnBhtdTjSXLr/cgbxOt46ZBySDi
TLSH
T182E41201EB86D8D8C53285B5E6F2E2F255307DECDA35661B16057F6EBC31BE0CA7A201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07.exe
- Size 649KB
- SHA256 d6f64e89040c34c50a245a787de7cb3e8591b79ad506596272a2cfd60f3c9d07
- MD5 1ec3ccb73ef98e16431612a7ad9f8900
- SHA1 54d49c75f34cc832f08a553fd4c9663d61ee7531
- SHA512 42747b0a30199e49737d5c9532667e3e0e7fd7513f24e61b12636ed3794ec9a4c80d69eb436d1bf972a34838dfe8ed8dba8d921ce70cce87a8adf4828e0de632
- SSDEEP 12288:Jtg++Nmxxy6BhAEPrwaWkCQjSX/jr/c13aQRHWxOzJ8T6Ll6Cvy4fKSCci:JMNmnBhtdTjSXLr/cgbxOt46ZBySDi
- TLSH
  T182E41201EB86D8D8C53285B5E6F2E2F255307DECDA35661B16057F6EBC31BE0CA7A201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 25KB
- SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
- MD5 4abf19a47044ec746aa8c600f0bc149f
- SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
- SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
- SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
- TLSH
  T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
- MD5 48452d7f73a0e73b62a16b4c88068a60
- SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
- SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
- SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
- TLSH
  T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6