Overview

overview

8

Static

static

5971fcdcf0...98.exe

windows7_x64

8

5971fcdcf0...98.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5971fcdcf0f563f502c8ab017f34567c15e3e76c7a3c1497ae8513c305f77798

  • Size

    184KB

  • Sample

    210411-mst4q52es6

  • MD5

    8f250f634de721fec7b002a805dddc24

  • SHA1

    8e177de1f0ec9d45417b27e47973b8ded74242c7

  • SHA256

    5971fcdcf0f563f502c8ab017f34567c15e3e76c7a3c1497ae8513c305f77798

  • SHA512

    d42a259868824429c4d6c7ed4aa5de1ddb3805d300feb39b51480a5232c0c05a74d9f27266ce60a796545f23e5de75896a8aa871ed93e5ab73ec01647175c191

Score
8/10
persistence

Malware Config

Targets

    • Target

      5971fcdcf0f563f502c8ab017f34567c15e3e76c7a3c1497ae8513c305f77798

    • Size

      184KB

    • MD5

      8f250f634de721fec7b002a805dddc24

    • SHA1

      8e177de1f0ec9d45417b27e47973b8ded74242c7

    • SHA256

      5971fcdcf0f563f502c8ab017f34567c15e3e76c7a3c1497ae8513c305f77798

    • SHA512

      d42a259868824429c4d6c7ed4aa5de1ddb3805d300feb39b51480a5232c0c05a74d9f27266ce60a796545f23e5de75896a8aa871ed93e5ab73ec01647175c191

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks