Overview

overview

10

Static

static

KAZGLDK7.exe

windows7_x64

10

KAZGLDK7.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    111a8502e03046675c3b498685dc3f3434770f71361710218d50f525285298c7

  • Size

    1.3MB

  • Sample

    220521-d1lmsabfdn

  • MD5

    e90d65bc6ff3fecaf4fb0f13526f02d6

  • SHA1

    9d74b43dab9f0ef299a7a1c3d3739a06ddbf9fc3

  • SHA256

    111a8502e03046675c3b498685dc3f3434770f71361710218d50f525285298c7

  • SHA512

    d4a72d8059f2aa5b016361c1834c67b157b821a07913e8f72530c87f1af4f6beea9bc909b472ecc136c1f0f387168abea50af25b627f564c7f96c7121d020562

Score
10/10
agilenetcoreentitypersistencerezer0

Malware Config

Targets

    • Target

      KAZGLDK7.EXE

    • Size

      796KB

    • MD5

      8776bc582b394da008bf1838d5a12239

    • SHA1

      527a52018952885beb39b5c5e1e35dff17b086d3

    • SHA256

      d80a482a5bff3bb4d0e6263d75c7eebf295d9027a1319a1c60100e2ec6ed2433

    • SHA512

      6bf4f3815124545e4b7ab65b146a0f0351d3a2cd7fb63448249f346f392da5d15b48ce8fbee1920d532707171d17a73af3029b03439dbc28295713212ad8d96e

    Score
    10/10
    agilenetcoreentityrezer0persistence

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Executes dropped EXE

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks