Overview

overview

8

Static

static

3

85e3f555f3...ae.exe

windows7_x64

8

85e3f555f3...ae.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85e3f555f34c270b5135b80da1273fa89ac8039cd48c4128cbe1d09e438555ae

  • Size

    8.8MB

  • Sample

    210508-c11ysalame

  • MD5

    97000facebbab449c06ddcdcdd51e825

  • SHA1

    5cdfbd6a6ff88644ba522402fe5fae5ecacbe71d

  • SHA256

    85e3f555f34c270b5135b80da1273fa89ac8039cd48c4128cbe1d09e438555ae

  • SHA512

    627a4842ce248d7ea98fe99b5f7ae9d25390564e112549ddc40fb5d26af3b1a4e837f9ebf853dfe4f91ba91efbb15e6c8dc649a2551f44fdc64ee1f2f5ca6d94

Score
8/10
macropersistencepyinstaller

Malware Config

Targets

    • Target

      85e3f555f34c270b5135b80da1273fa89ac8039cd48c4128cbe1d09e438555ae

    • Size

      8.8MB

    • MD5

      97000facebbab449c06ddcdcdd51e825

    • SHA1

      5cdfbd6a6ff88644ba522402fe5fae5ecacbe71d

    • SHA256

      85e3f555f34c270b5135b80da1273fa89ac8039cd48c4128cbe1d09e438555ae

    • SHA512

      627a4842ce248d7ea98fe99b5f7ae9d25390564e112549ddc40fb5d26af3b1a4e837f9ebf853dfe4f91ba91efbb15e6c8dc649a2551f44fdc64ee1f2f5ca6d94

    Score
    8/10
    macropersistencepyinstaller

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks