Overview

overview

10

Static

static

f9a43cb541...83.exe

windows7-x64

10

f9a43cb541...83.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f9a43cb54117b3414548c11cba12f2ad15efb7b22ee2e81028cf6967f0baec83

  • Size

    228KB

  • Sample

    221002-at7d5afaeq

  • MD5

    6ea7bb8e50e8196a54340ed09175b420

  • SHA1

    65dfb95d3c818d48d1f9fb447a7791fafb94dc0d

  • SHA256

    f9a43cb54117b3414548c11cba12f2ad15efb7b22ee2e81028cf6967f0baec83

  • SHA512

    30c328631cfd96284c43007714586af43ab0439a9e3496bbec4ca4c6250d9c69e697ab6d7099b7b7ea5cf62ef8685a473f298a0e6e708f53cd165ce8a0a2703a

  • SSDEEP

    6144:liwOYMmQolHQDinWTZqAukQJ3aCynEMOgL8y6E:wZnDinWTYAukQJ3pynEMOgL8y6

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      f9a43cb54117b3414548c11cba12f2ad15efb7b22ee2e81028cf6967f0baec83

    • Size

      228KB

    • MD5

      6ea7bb8e50e8196a54340ed09175b420

    • SHA1

      65dfb95d3c818d48d1f9fb447a7791fafb94dc0d

    • SHA256

      f9a43cb54117b3414548c11cba12f2ad15efb7b22ee2e81028cf6967f0baec83

    • SHA512

      30c328631cfd96284c43007714586af43ab0439a9e3496bbec4ca4c6250d9c69e697ab6d7099b7b7ea5cf62ef8685a473f298a0e6e708f53cd165ce8a0a2703a

    • SSDEEP

      6144:liwOYMmQolHQDinWTZqAukQJ3aCynEMOgL8y6E:wZnDinWTYAukQJ3pynEMOgL8y6

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks