Overview

overview

10

Static

static

5f282f5a94...7d.exe

windows7-x64

10

5f282f5a94...7d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5f282f5a94845d5f5d9e01a56850977d.exe

  • Size

    151KB

  • Sample

    220913-xemgqscbfp

  • MD5

    5f282f5a94845d5f5d9e01a56850977d

  • SHA1

    bcf7d29f3f8a07501bd446b8af76f94365de1003

  • SHA256

    527d880364a9ac1bd164abf1e2670de97fec74cbca3b9416bd5e54a52c272daa

  • SHA512

    a84d8d88829bc4f2db3a2c4fa86cc383ccf28b13efc8bd89378175c6f49e5403460b08679bbe89a6073f637fb4c4277c05e88edef7e2b15904e7a5ac01f1da07

  • SSDEEP

    3072:50udufErHlYJYgGviswYAyDDlbiQTYzafJkAWbW2:SMMGTRvDxbiTPAWr

Score
10/10
persistence

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/obieznne.msi

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/KMS_Tool.msi

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/cmd.msi
exe.dropper

http://cothdesigns2.com:443/xmlo.msi

Targets

    • Target

      5f282f5a94845d5f5d9e01a56850977d.exe

    • Size

      151KB

    • MD5

      5f282f5a94845d5f5d9e01a56850977d

    • SHA1

      bcf7d29f3f8a07501bd446b8af76f94365de1003

    • SHA256

      527d880364a9ac1bd164abf1e2670de97fec74cbca3b9416bd5e54a52c272daa

    • SHA512

      a84d8d88829bc4f2db3a2c4fa86cc383ccf28b13efc8bd89378175c6f49e5403460b08679bbe89a6073f637fb4c4277c05e88edef7e2b15904e7a5ac01f1da07

    • SSDEEP

      3072:50udufErHlYJYgGviswYAyDDlbiQTYzafJkAWbW2:SMMGTRvDxbiTPAWr

    Score
    10/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks