Overview

overview

10

Static

static

24659e867b...eb.exe

windows7-x64

10

24659e867b...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24659e867bd7aefc21e63df8230cbb55cdadd29cacdd5bf7c9ef7dcd69bf19eb

  • Size

    234KB

  • Sample

    221003-ddekysdag9

  • MD5

    6939fe26996107774c4f5f53139f6bf0

  • SHA1

    6e3520d92e9e3d3ea17ac02364433134a2409a6e

  • SHA256

    24659e867bd7aefc21e63df8230cbb55cdadd29cacdd5bf7c9ef7dcd69bf19eb

  • SHA512

    1a058304e0111679c5fdff2f97c988bda5deec3604938c898ab8559296404858a24c9f7d0df8ee4486f41278beea319cc69b3810bd947d0ca68b5fd8dabe117a

  • SSDEEP

    3072:H7ujS5TtVfzvt4Q4RXSGi0nYTLpRUr94R1R1oiiFF+ZObMzqdJKtSL:NTDOzRXvYROk2iiIObMzq+0

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      24659e867bd7aefc21e63df8230cbb55cdadd29cacdd5bf7c9ef7dcd69bf19eb

    • Size

      234KB

    • MD5

      6939fe26996107774c4f5f53139f6bf0

    • SHA1

      6e3520d92e9e3d3ea17ac02364433134a2409a6e

    • SHA256

      24659e867bd7aefc21e63df8230cbb55cdadd29cacdd5bf7c9ef7dcd69bf19eb

    • SHA512

      1a058304e0111679c5fdff2f97c988bda5deec3604938c898ab8559296404858a24c9f7d0df8ee4486f41278beea319cc69b3810bd947d0ca68b5fd8dabe117a

    • SSDEEP

      3072:H7ujS5TtVfzvt4Q4RXSGi0nYTLpRUr94R1R1oiiFF+ZObMzqdJKtSL:NTDOzRXvYROk2iiIObMzq+0

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks