General
- Target CCS_external.exe
- Size 75.5MB
- Sample260825-2grlpazcqf
- SHA256 3bbb2b59759f314e6e9eb134605b9135db1d0c2f70f3e5aaf07238c31ab5de59
- MD5 f60909d3563bc9ab1d6e82aea9b852c5
- SHA1 662232247475d9664dcc86b5c8dac7b93f6c76d2
- SHA512 0d02ed9ae77ef85653aa6796ada9f205d997c8eb0cfad86369c3807e7bac8919f4ce2da30a794d0fde2d179ba0676fe65135360813487f34309fe60d451bd8b8
- SSDEEP 1572864:xKXzjvUMOtMWCQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7aq5qq:4XPUX2dQI5BB7tE0WGN4cvZagqq
- TLSH T1040833059A16569FF28DA737F2E2D92B3BD2244B8759C0CD1BD00D078BA71C9DE79C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
CCS_external.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
CCS_external.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target CCS_external.exe
- Size 75.5MB
- SHA256 3bbb2b59759f314e6e9eb134605b9135db1d0c2f70f3e5aaf07238c31ab5de59
- MD5 f60909d3563bc9ab1d6e82aea9b852c5
- SHA1 662232247475d9664dcc86b5c8dac7b93f6c76d2
- SHA512 0d02ed9ae77ef85653aa6796ada9f205d997c8eb0cfad86369c3807e7bac8919f4ce2da30a794d0fde2d179ba0676fe65135360813487f34309fe60d451bd8b8
- SSDEEP 1572864:xKXzjvUMOtMWCQ+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7aq5qq:4XPUX2dQI5BB7tE0WGN4cvZagqq
- TLSH T1040833059A16569FF28DA737F2E2D92B3BD2244B8759C0CD1BD00D078BA71C9DE79C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1