e7b94427985ce2f50141efe4fdc5c4c6b7fab073671fcced531cea522e81d0a2

Sharing

Copy URL Twitter E-mail

General

Target
e7b94427985ce2f50141efe4fdc5c4c6b7fab073671fcced531cea522e81d0a2.exe
Size 246KB
Sample260810-zrtgxstsbs
SHA256 e7b94427985ce2f50141efe4fdc5c4c6b7fab073671fcced531cea522e81d0a2
MD5 004221a5a1ce75f97f3c50c288ea0968
SHA1 3992652657423163a6829e94cd5ff06340330ac1
SHA512 cd08bf808bcb008d4794ec88c6c110cc70a2040f1619ae24b6536e6223988677735b56a94851f7b1cc0eed4e445f889f431105ea034441de3a87e42127cdc0e6
SSDEEP 6144:s1ssjCzq5rUBdMVr7ePaY6AlvBzDu3fqpc3Iinmox:RsezX+VveCIRBzmfC4Vnmox
TLSH
T1CD341212F7B1D8A6D6252A704C75B6A29FE7CE1311DC272B4FA87F5A3D32245880E1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  e7b94427985ce2f50141efe4fdc5c4c6b7fab073671fcced531cea522e81d0a2.exe
- Size 246KB
- SHA256 e7b94427985ce2f50141efe4fdc5c4c6b7fab073671fcced531cea522e81d0a2
- MD5 004221a5a1ce75f97f3c50c288ea0968
- SHA1 3992652657423163a6829e94cd5ff06340330ac1
- SHA512 cd08bf808bcb008d4794ec88c6c110cc70a2040f1619ae24b6536e6223988677735b56a94851f7b1cc0eed4e445f889f431105ea034441de3a87e42127cdc0e6
- SSDEEP 6144:s1ssjCzq5rUBdMVr7ePaY6AlvBzDu3fqpc3Iinmox:RsezX+VveCIRBzmfC4Vnmox
- TLSH
  T1CD341212F7B1D8A6D6252A704C75B6A29FE7CE1311DC272B4FA87F5A3D32245880E1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
- MD5 792b6f86e296d3904285b2bf67ccd7e0
- SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
- SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
- SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
- TLSH
  T140425A0583618EF3F5962D3C00667E2F2B79BE3416F140639FE34481A99A1CFA975392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e
- MD5 f5b0c649b0cfc103fb113d013d48cacb
- SHA1 f89286966000cb053b7e94100c76ec6d1129af07
- SHA512 e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01
- SSDEEP 96:oYDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4V8qndYv0PLE:oYp34z/x3sREskpxSdO0PLE
- TLSH
  T15612F8135A4454B3C9E6223A31AA2F2EDB3C932490627D02C7779E1A2BB42167D3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 10675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
- MD5 5aa38904acdcc21a2fb8a1d30a72d92f
- SHA1 a9ce7d1456698921791db91347dba0489918d70c
- SHA512 f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
- SSDEEP 96:AOBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+uHwEX:AhB2flXAVJtjf6cBbcB/N8Ved0PZ
- TLSH
  T1A3D1D53A2AD12DF3D14889702817793B8BB9D8360F604650DB6B1AE535E5CE7DB3038B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8