Overview

overview

8

Static

static

0ab4025127...c9.exe

windows7-x64

8

0ab4025127...c9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

  • Size

    535KB

  • Sample

    221003-eacgvsgaer

  • MD5

    6acd1647078d560a5ec3d53f85b5c709

  • SHA1

    5d55d16df9e337800c7410a819ee7b56f7b4b31e

  • SHA256

    0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

  • SHA512

    08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

  • SSDEEP

    12288:vSo6xg5kN530xuooqMVwsgTo6xg5kN530xuooqT:b6u5030x+gE6u5030xD

Score
8/10
collectionevasionpersistence

Malware Config

Targets

    • Target

      0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

    • Size

      535KB

    • MD5

      6acd1647078d560a5ec3d53f85b5c709

    • SHA1

      5d55d16df9e337800c7410a819ee7b56f7b4b31e

    • SHA256

      0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

    • SHA512

      08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

    • SSDEEP

      12288:vSo6xg5kN530xuooqMVwsgTo6xg5kN530xuooqT:b6u5030x+gE6u5030xD

    Score
    8/10
    collectionevasionpersistence

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks