Overview

overview

10

Static

static

acb1764410...81.exe

windows7-x64

10

acb1764410...81.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    acb1764410fce03fb1c6f434963194ef660c6c7a378d9c3d2c141904af60fa81

  • Size

    236KB

  • Sample

    221003-dmrlwadec2

  • MD5

    64bc8d807a6aaedeba530d53f8af10f0

  • SHA1

    558c1bba365a77467466f108c866a573248ee1b9

  • SHA256

    acb1764410fce03fb1c6f434963194ef660c6c7a378d9c3d2c141904af60fa81

  • SHA512

    499416fc36a95384ec4bee8db89a5c72e2b1df03fcf992d6596b18675d963be441e0476578d35195a5450e199f542cb5c069fe0770c49f1598f99580c2f19fb6

  • SSDEEP

    6144:+XxfhDsx89HLk/sM6FF7Hi4jKfT7kjPAQwqu7BcDcgCumpQD:5x89rk7n7kjPBwtte6M

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      acb1764410fce03fb1c6f434963194ef660c6c7a378d9c3d2c141904af60fa81

    • Size

      236KB

    • MD5

      64bc8d807a6aaedeba530d53f8af10f0

    • SHA1

      558c1bba365a77467466f108c866a573248ee1b9

    • SHA256

      acb1764410fce03fb1c6f434963194ef660c6c7a378d9c3d2c141904af60fa81

    • SHA512

      499416fc36a95384ec4bee8db89a5c72e2b1df03fcf992d6596b18675d963be441e0476578d35195a5450e199f542cb5c069fe0770c49f1598f99580c2f19fb6

    • SSDEEP

      6144:+XxfhDsx89HLk/sM6FF7Hi4jKfT7kjPAQwqu7BcDcgCumpQD:5x89rk7n7kjPBwtte6M

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks