General
- Target MonkeModManager.exe
- Size 93KB
- Sample260826-emmtcsywcx
- SHA256 894b5eecc3dbf2f73dbbf5e0442c8ecbdf676bfa8a952f89b0a4978769677c51
Score
9/10
Malware Config
Targets
-
- Target MonkeModManager.exe
- Size 93KB
- SHA256 894b5eecc3dbf2f73dbbf5e0442c8ecbdf676bfa8a952f89b0a4978769677c51
Score9/10-
Looks for VirtualBox Guest Additions in registry
-
Downloads MZ/PE file
-
Looks for VMWare Tools registry key
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Defense Evasion
Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
2