General
Target

05c7101db899b4a4d29f3009878124f8bbce6d0df49e9dba9b381c44e2357d3c

Size

3MB

Sample

220520-fd3nwsddak

Score
8/10
MD5

8f624f06bacd6651334446e80ff16972

SHA1

0494097ab18dc74945acdbca430c91d4d1a3e3b4

SHA256

05c7101db899b4a4d29f3009878124f8bbce6d0df49e9dba9b381c44e2357d3c

SHA512

df64645de7143ae36ccee595365dd9e5f8a14cba463451b8fb0a1385b7262d43e11e6e39d915946443ee74bc7bc6d7de9e92b2e2db65e1142b33983ca46105f8

Malware Config
Targets
Target

05c7101db899b4a4d29f3009878124f8bbce6d0df49e9dba9b381c44e2357d3c

MD5

8f624f06bacd6651334446e80ff16972

Filesize

3MB

Score
8/10
SHA1

0494097ab18dc74945acdbca430c91d4d1a3e3b4

SHA256

05c7101db899b4a4d29f3009878124f8bbce6d0df49e9dba9b381c44e2357d3c

SHA512

df64645de7143ae36ccee595365dd9e5f8a14cba463451b8fb0a1385b7262d43e11e6e39d915946443ee74bc7bc6d7de9e92b2e2db65e1142b33983ca46105f8

Tags

Signatures

  • Executes dropped EXE

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery
  • Writes to the Master Boot Record (MBR)

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    Tags

    TTPs

    Bootkit

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    1/10