5681ba3f57191313feaab3024b25879408e1523dcbda6bb6b092bcedfb49fd53

Sharing

Copy URL Twitter E-mail

General

Target
t7patch_3.03.Windows.Only.zip
Size 4.8MB
Sample260908-b53qrabl4v
SHA256 5681ba3f57191313feaab3024b25879408e1523dcbda6bb6b092bcedfb49fd53
MD5 027254a890091ca7714c9e41c1c4bf31
SHA1 d831cba2af52cdb2f2906dc377869c1a93c6c50b
SHA512 1bfb43f9c186306efb34309c382712a8d9a1f361467668a2ad2e01af9e03a6e380407b8925971c28b571ae4d12e6b6c4e9c0b16634496db8a1a3b58fd88032bd
SSDEEP 98304:0V0O33Ng1yJCHTGPQ1TtCjZ1F1XjxU2ZPNAG422vlm6JRjTzB2:0VNtC/HqPQ1uPdumNRH2vZHt2
TLSH
T1F8363316BC3AB74C7D678DBC97608A513AE321338FFE45C2F2763530A5F6664488B168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  t7patch_3.03.Windows.Only/External.dll
- Size 6.3MB
- SHA256 1e20051266b78c9a0834cc817c30ac9b95fe725f2e6cb2accdd98b8aeb4b5fcf
- MD5 d4369a1a235b49b294c75319b23c39f6
- SHA1 211b67a455718863e83d497bd23682857efec05a
- SHA512 178b7196f11be7288805868d29c54d6d6a30ef0ac35c577e86c7c55826dea42ba32dbe5ce100abf8f40bc0acefd909d4a16e772e76639cb504a0566f7bb2d131
- SSDEEP 98304:1GtZbJrYKB6HzABsbDx2j55z7jnNUipLVuG6YyvXYqrzQ9:sR6HEBsbQ9fuWV3vyvZ
- TLSH
  T15166AF28EB838E17EBD9273290B645155631E25A3707BB7F2B39A5397D833704E123D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  t7patch_3.03.Windows.Only/Microsoft.Bcl.AsyncInterfaces.dll
- Size 20KB
- SHA256 075ce79e84041137c78885b3738c1b5a03547d0ae2a79916e844196a9d0ec1db
- MD5 1ee251645b8a54a116d6d06c83a2bd85
- SHA1 5dbf1534ffbff016cc45559eb5eff3dc4252a522
- SHA512 9f67fd0566eac2da4253d08697daab427e4e85780615d940f086a88424dcbb0563abae7e4824088e64ef7024c1bb3bbf324f2d07bc7ba55f79e4af3c9ea88e97
- SSDEEP 384:69P2wZOXm7YJVHTe+0VJI0vrdaVemxO/f7vWeq/WIdHRN7bg30uw7lGsV9W+:u2zmYrHCV9cIL6TbtCSW
- TLSH
  T144927C25D76C4213DEBB2AB7E9B5D6036F38E3D64800E22E144CF1691CD33CA5B2262D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  t7patch_3.03.Windows.Only/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  t7patch_3.03.Windows.Only/System.Memory.dll
- Size 137KB
- SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
- MD5 6fb95a357a3f7e88ade5c1629e2801f8
- SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
- SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
- SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
- TLSH
  T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  t7patch_3.03.Windows.Only/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  t7patch_3.03.Windows.Only/System.Runtime.CompilerServices.Unsafe.dll
- Size 16KB
- SHA256 3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
- MD5 9a341540899dcc5630886f2d921be78f
- SHA1 bab44612721c3dc91ac3d9dfca7c961a3a511508
- SHA512 066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
- SSDEEP 192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
- TLSH
  T18F724B45CBEC4607ED232B7085A8D583FF38A3D75816A32929C5F67C0C9A7C5AF21638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  t7patch_3.03.Windows.Only/System.Text.Encodings.Web.dll
- Size 64KB
- SHA256 f2ee33438b8bf433de726c8d580caef8757fca062bdb5bbe5394f0347f23a83a
- MD5 d39dd61b1376d5b4074b1849ee10b09e
- SHA1 23a0b63a62a6f0907daf759088a2a489990fcf2f
- SHA512 ac9f172170d86c6914fd4e0da8bb5c98cad4806243824a46d480eb8785f94d2c68b6909a7c93663ef22f8810d7d839cc3e914d181fa28c5334f3c1acca1a606a
- SSDEEP 768:g1snZJ4a6YcS0YvZQWni0DXslCe+WsNkNt3l5a6CDchPeINq2ZyYkep7:7mYcB8ioJqStwdY2ZyYkep7
- TLSH
  T1D2534A21BB88E91DCB5D12741860907CE7BDAF6A1212B2930C96FC1A17773DC721E9F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  t7patch_3.03.Windows.Only/System.Text.Json.dll
- Size 347KB
- SHA256 2b0d20516ab8136faee06e0e2a9ffb03ba747ebd7da0f5db61a36895cdebb166
- MD5 a11c491b7135ffd620e249bf74ea5f1e
- SHA1 df505c2ff55722d3f552d4a7a72c9fcadfb5b60c
- SHA512 f1815e3af674658c0126e0be299b56852d43ad153e9e73291e80656f5cb37390b8f959ca13e99f04b5d3f7a590d8e31f22f5a0906bf934d4375475f3c7701b53
- SSDEEP 3072:v8oMR3AYofrtwGIkTL89zbgjYrgmZQAipJao8i/9Fm6ZYKKnca7/4RrHb9QI46b3:aLqt2kD0QAibao8INWqrHJVb3
- TLSH
  T1AA745A006BDCDB27EAFF5774E0B884049F7EF62A6B67E758918854FD0D02754A0822E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  t7patch_3.03.Windows.Only/System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  t7patch_3.03.Windows.Only/System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH
  T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  t7patch_3.03.Windows.Only/t7dwidm_protect.exe
- Size 224KB
- SHA256 e34ce43c1ceb6e55e42a31c227eecf5c4e90a9174c3fcf499cb4ba0b98b973ce
- MD5 e3129d54b296d051dc978eb59f33d959
- SHA1 6cbf9f1e102d398b0a6932b5dcf4a442494be745
- SHA512 618d6caff33e6cd7d1273e644f4fb5f7223860af1bef2a2af5e005c04a7cf5cf9702b64ad97fb19638d68069a37fd44ddcd31ca2a1b97b9c86860642e6b8ca22
- SSDEEP 3072:6Xof5jOGkE3vCQ18ILBIL8gcBNj/SkdWDwY81laCs+O+vPZh2Uk0Vo67tLvBaMFU:PfZh8QfgdeDO+vXE676MFu1wSKV
- TLSH
  T114245B26B774407BC77992F8D5135D21E7B2B88147A1E7CF1B9062EA1E627C0AB39343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11
- Target
  t7patch_3.03.Windows.Only/t7dwidm_protect.exe.config
- Size 550B
- SHA256 5c456fadedc86ab0d33161e685b4c833772344446d13e8ca7db94b7c0b176cf2
- MD5 7b10d658fc2b756c20f57087f1e078dd
- SHA1 5bfea593e78908899bfaa96001892583b6e2e1c5
- SHA512 cbf6ae5b1ad771613b54c09d433fca2318d4b90c8b023ef4601c3734b441d78af45d4f2b0d82ca032e1d238118bbf21bdf3deb4f7a9792909a52df710146da78
- TLSH
  T100F0592084E8EEA68F515AA32A6550248FF843B3298C004CB4AEAC56CF0068E5307276
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12