Overview

overview

8

Static

static

Windows_Host.exe

windows7-x64

8

Windows_Host.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Windows_Host.exe

  • Size

    23KB

  • Sample

    220923-g3a6lshceq

  • MD5

    e741d5bfc78ea9002c079dc8aeee3a19

  • SHA1

    67e008479b7b59af8af6a697a9a8631f8973ed0a

  • SHA256

    3dcc436b69d621e1d71123ac70836d6f861ba82fc6551390d6702a9670d07767

  • SHA512

    e8dd44773abfc86de1a234e33b850b86d762d32232c056b5362857b9f6293ade6fd9164a4eb6e88053eefa01415dfd4da49bab29d6d25fd2f0b565745cb9166c

  • SSDEEP

    384:mE+EVqGOu+2HS5BE+ERWzMIQdkROJoJmxIit2XXRqb3RXCROCPxh91aTRRbuwv9+:m9EVM2u9ERunQDxIitPbto7vaT194zrd

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      Windows_Host.exe

    • Size

      23KB

    • MD5

      e741d5bfc78ea9002c079dc8aeee3a19

    • SHA1

      67e008479b7b59af8af6a697a9a8631f8973ed0a

    • SHA256

      3dcc436b69d621e1d71123ac70836d6f861ba82fc6551390d6702a9670d07767

    • SHA512

      e8dd44773abfc86de1a234e33b850b86d762d32232c056b5362857b9f6293ade6fd9164a4eb6e88053eefa01415dfd4da49bab29d6d25fd2f0b565745cb9166c

    • SSDEEP

      384:mE+EVqGOu+2HS5BE+ERWzMIQdkROJoJmxIit2XXRqb3RXCROCPxh91aTRRbuwv9+:m9EVM2u9ERunQDxIitPbto7vaT194zrd

    Score
    8/10
    evasionpersistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Registers COM server for autorun

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks