Overview

overview

10

Static

static

51c4fc876d...ac.exe

windows7-x64

10

51c4fc876d...ac.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    51c4fc876d7f3390198b1a887ae00874c14a68b5b2e6f2cafa695ad274f4a6ac

  • Size

    320KB

  • Sample

    221003-c2jzxacdh2

  • MD5

    64a647f63ea0306f43bbf5ccd662a370

  • SHA1

    b78adb76af0733e169734c5ec8bb3079db50a84c

  • SHA256

    51c4fc876d7f3390198b1a887ae00874c14a68b5b2e6f2cafa695ad274f4a6ac

  • SHA512

    03f3582b10178b1ca2f64b9431eaf66b81299f949dbe8a9218c4413341b16e479933eb6c378c1711a94478132fb057c53a634c3d283f8ff942ace92d8f066109

  • SSDEEP

    6144:6TwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:UXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      51c4fc876d7f3390198b1a887ae00874c14a68b5b2e6f2cafa695ad274f4a6ac

    • Size

      320KB

    • MD5

      64a647f63ea0306f43bbf5ccd662a370

    • SHA1

      b78adb76af0733e169734c5ec8bb3079db50a84c

    • SHA256

      51c4fc876d7f3390198b1a887ae00874c14a68b5b2e6f2cafa695ad274f4a6ac

    • SHA512

      03f3582b10178b1ca2f64b9431eaf66b81299f949dbe8a9218c4413341b16e479933eb6c378c1711a94478132fb057c53a634c3d283f8ff942ace92d8f066109

    • SSDEEP

      6144:6TwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:UXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks