Overview

overview

10

Static

static

90d5cb8412...66.exe

windows7-x64

10

90d5cb8412...66.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    90d5cb8412f5770c87eea8c57a5348bc6680093e95f53fc3c1189cd9ff03a366

  • Size

    83KB

  • Sample

    221002-11q9laebgj

  • MD5

    005f0f7b30ff89b3f2ae30dbb2a584e2

  • SHA1

    e3ed2eca5ae6503a7cf109bb15d4f376a7e35c6b

  • SHA256

    90d5cb8412f5770c87eea8c57a5348bc6680093e95f53fc3c1189cd9ff03a366

  • SHA512

    88521bb7143f792c0f17a85190ef417038c3954c12382dc2e04022028a55a5153e268ced790b75f3d2a9b420f431eb06bbf71dad538d6ca4e13c675987bedd4b

  • SSDEEP

    1536:bM18oDvM1Y+oCpwSAt5P4mObFRyPrZ5rvf49zSO:Q8IMy3T5JZ98zSO

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      90d5cb8412f5770c87eea8c57a5348bc6680093e95f53fc3c1189cd9ff03a366

    • Size

      83KB

    • MD5

      005f0f7b30ff89b3f2ae30dbb2a584e2

    • SHA1

      e3ed2eca5ae6503a7cf109bb15d4f376a7e35c6b

    • SHA256

      90d5cb8412f5770c87eea8c57a5348bc6680093e95f53fc3c1189cd9ff03a366

    • SHA512

      88521bb7143f792c0f17a85190ef417038c3954c12382dc2e04022028a55a5153e268ced790b75f3d2a9b420f431eb06bbf71dad538d6ca4e13c675987bedd4b

    • SSDEEP

      1536:bM18oDvM1Y+oCpwSAt5P4mObFRyPrZ5rvf49zSO:Q8IMy3T5JZ98zSO

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks