Overview

overview

10

Static

static

9f1390d294...70.exe

windows7-x64

10

9f1390d294...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9f1390d294ddd6ddde5074ba91e51dffdfddcab73929a0b39ea2321cb6bcc870

  • Size

    1016KB

  • Sample

    221011-djxzgsbhh7

  • MD5

    4f1d379e9c2e953f8c10b3460ef54880

  • SHA1

    d08c5c9279e1b6db95021e9d32c351a84729efb0

  • SHA256

    9f1390d294ddd6ddde5074ba91e51dffdfddcab73929a0b39ea2321cb6bcc870

  • SHA512

    3daedf019b8b2b97e85a54bb82d7f258c1f8c125d2aa7e75f18f32ba739ed5555ebb16be52e2950e1a6336e339ad79f937eb86c0ad4b7b250dd8a7b7e3da5d0a

  • SSDEEP

    6144:GIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:GIXsgtvm1De5YlOx6lzBH46Umu1q

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      9f1390d294ddd6ddde5074ba91e51dffdfddcab73929a0b39ea2321cb6bcc870

    • Size

      1016KB

    • MD5

      4f1d379e9c2e953f8c10b3460ef54880

    • SHA1

      d08c5c9279e1b6db95021e9d32c351a84729efb0

    • SHA256

      9f1390d294ddd6ddde5074ba91e51dffdfddcab73929a0b39ea2321cb6bcc870

    • SHA512

      3daedf019b8b2b97e85a54bb82d7f258c1f8c125d2aa7e75f18f32ba739ed5555ebb16be52e2950e1a6336e339ad79f937eb86c0ad4b7b250dd8a7b7e3da5d0a

    • SSDEEP

      6144:GIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:GIXsgtvm1De5YlOx6lzBH46Umu1q

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks