77fd0772f893d22be94a090a43020c55440ed61b7719a4b9ca343f954ca0ab79 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

77fd0772f893d22be94a090a43020c55440ed61b7719a4b9ca343f954ca0ab79
Size

64KB
Sample

220919-z95ynsdfbj
MD5

a89877f2a68b0eb142d6208d84556997
SHA1

c3aead6ae6855bb05799a49089a0a5e61b27d458
SHA256

77fd0772f893d22be94a090a43020c55440ed61b7719a4b9ca343f954ca0ab79
SHA512

bf4413e8e4043513f98c5f4c4a20b85f1a63c4222c04b44afcd616250551cf2d055d3c31185c275b49f1b370ee4e2d669a3170a562c13e6ee0848053843a6cef
SSDEEP

1536:XUTXdRfpeHhlAeA19/MhsBeGaja69aSRqa5fmAVm:ETXrwGeA1+hQ3UUSUa5f

Score

8^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  77fd0772f893d22be94a090a43020c55440ed61b7719a4b9ca343f954ca0ab79
- Size
  
  64KB
- MD5
  
  a89877f2a68b0eb142d6208d84556997
- SHA1
  
  c3aead6ae6855bb05799a49089a0a5e61b27d458
- SHA256
  
  77fd0772f893d22be94a090a43020c55440ed61b7719a4b9ca343f954ca0ab79
- SHA512
  
  bf4413e8e4043513f98c5f4c4a20b85f1a63c4222c04b44afcd616250551cf2d055d3c31185c275b49f1b370ee4e2d669a3170a562c13e6ee0848053843a6cef
- SSDEEP
  
  1536:XUTXdRfpeHhlAeA19/MhsBeGaja69aSRqa5fmAVm:ETXrwGeA1+hQ3UUSUa5f
Score

8^/10

persistence evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistencetrojan