Overview

overview

10

Static

static

20c35c9a67...d2.exe

windows7-x64

10

20c35c9a67...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20c35c9a6787dcfabb6ff6916b51888101c9ec3e38375ee21b304be7d7056ed2

  • Size

    124KB

  • Sample

    220919-epmldafdd7

  • MD5

    fe5d48d60fc5084976230c74f3057fd8

  • SHA1

    f88dcc9664948bb47707041c2ce18aed58001b9c

  • SHA256

    20c35c9a6787dcfabb6ff6916b51888101c9ec3e38375ee21b304be7d7056ed2

  • SHA512

    2f80dfa8f203ed503797b7ddc24c230c5dca0425e879f0a38b6b8999586191700a368f60038e8fb388e562967815e68c6e24e56708065bc9bf22e8dc417a5092

  • SSDEEP

    1536:SotkjdTQ6ecmU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeRPNeG0h/y:pkjC6ecmU0GgAT9QIq

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      20c35c9a6787dcfabb6ff6916b51888101c9ec3e38375ee21b304be7d7056ed2

    • Size

      124KB

    • MD5

      fe5d48d60fc5084976230c74f3057fd8

    • SHA1

      f88dcc9664948bb47707041c2ce18aed58001b9c

    • SHA256

      20c35c9a6787dcfabb6ff6916b51888101c9ec3e38375ee21b304be7d7056ed2

    • SHA512

      2f80dfa8f203ed503797b7ddc24c230c5dca0425e879f0a38b6b8999586191700a368f60038e8fb388e562967815e68c6e24e56708065bc9bf22e8dc417a5092

    • SSDEEP

      1536:SotkjdTQ6ecmU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeRPNeG0h/y:pkjC6ecmU0GgAT9QIq

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks