Overview

overview

10

Static

static

d26c5ebd1d...3a.exe

windows7-x64

10

d26c5ebd1d...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d26c5ebd1d7fb1d5b8f8ef313d408b3a.exe

  • Size

    43KB

  • Sample

    220914-h4c72ahee3

  • MD5

    d26c5ebd1d7fb1d5b8f8ef313d408b3a

  • SHA1

    1a2386f8d8e5f64eaf404e74c97ed94dc50627c7

  • SHA256

    c4ac79bf17fc00f26e2acdeeb0466da96ed9b928df1dd99b8c865a872bb2143d

  • SHA512

    dcdb0c5b3128379974ed1604d9196a486c7610867a29b6d985e9baf37485eb96397ce96ff8bd15490e93d6135afa5ca17136bfaa25892a17d4919fded8897fc9

  • SSDEEP

    768:Z84x3tuZYVP1stOVTBdlDR0YIWEj+JtrU0bLekwijxBY1SVvKnxKcS8bgGbaG6gk:Vx3VVVzd7Ej+7tbLek7jxG1SVSnccS8a

Score
10/10
persistence

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/obieznne.msi

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/H2022_Tool.msi

Extracted

Language
ps1
Source
URLs
exe.dropper

http://cothdesigns2.com:443/cmd.msi
exe.dropper

http://cothdesigns2.com:443/xmlo.msi

Targets

    • Target

      d26c5ebd1d7fb1d5b8f8ef313d408b3a.exe

    • Size

      43KB

    • MD5

      d26c5ebd1d7fb1d5b8f8ef313d408b3a

    • SHA1

      1a2386f8d8e5f64eaf404e74c97ed94dc50627c7

    • SHA256

      c4ac79bf17fc00f26e2acdeeb0466da96ed9b928df1dd99b8c865a872bb2143d

    • SHA512

      dcdb0c5b3128379974ed1604d9196a486c7610867a29b6d985e9baf37485eb96397ce96ff8bd15490e93d6135afa5ca17136bfaa25892a17d4919fded8897fc9

    • SSDEEP

      768:Z84x3tuZYVP1stOVTBdlDR0YIWEj+JtrU0bLekwijxBY1SVvKnxKcS8bgGbaG6gk:Vx3VVVzd7Ej+7tbLek7jxG1SVSnccS8a

    Score
    10/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks