Overview

overview

8

Static

static

2d51e88396...7a.exe

windows7_x64

8

2d51e88396...7a.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d51e8839680d32501ca98ea74ccfa56189c28d483968acd8309ea38f6745f7a

  • Size

    628KB

  • Sample

    220614-yjb28sacdl

  • MD5

    aa325b98e7e74bd29564c815adf449a8

  • SHA1

    665f7e46049987a8eb666d66d8055ef6721d630e

  • SHA256

    2d51e8839680d32501ca98ea74ccfa56189c28d483968acd8309ea38f6745f7a

  • SHA512

    832cceaab68c7d070eb7ad4e676164dcb283b71e80633621e92e60279cd94f35201dafc62ec8ecce1c2ad8dfa93b68e90b48d46f22c87d3af1c23937847ac146

Score
8/10
collectionpersistence

Malware Config

Targets

    • Target

      2d51e8839680d32501ca98ea74ccfa56189c28d483968acd8309ea38f6745f7a

    • Size

      628KB

    • MD5

      aa325b98e7e74bd29564c815adf449a8

    • SHA1

      665f7e46049987a8eb666d66d8055ef6721d630e

    • SHA256

      2d51e8839680d32501ca98ea74ccfa56189c28d483968acd8309ea38f6745f7a

    • SHA512

      832cceaab68c7d070eb7ad4e676164dcb283b71e80633621e92e60279cd94f35201dafc62ec8ecce1c2ad8dfa93b68e90b48d46f22c87d3af1c23937847ac146

    Score
    8/10
    collectionpersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks