Overview

overview

10

Static

static

35368856dd...51.exe

windows7-x64

10

35368856dd...51.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    35368856dd498b5c4a2f57ea205316db7278a11a8f71a01babd6c535dff02551

  • Size

    1016KB

  • Sample

    221011-dk4tescac7

  • MD5

    609b54ca07635ba7e209cf42f5d0cc30

  • SHA1

    c775eacbd0ab15c470539a7b31de5b4c3ef8f107

  • SHA256

    35368856dd498b5c4a2f57ea205316db7278a11a8f71a01babd6c535dff02551

  • SHA512

    605ec6ba9cbddbc4850a2a5fbc4e38c63a653a4f7bd6728bb203f711e16f367b4b80ec4aaf94810351351ad46137e86d023d23af61b54d2c85bf0fba8bd7be7d

  • SSDEEP

    6144:lIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:lIXsgtvm1De5YlOx6lzBH46Umu1q

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      35368856dd498b5c4a2f57ea205316db7278a11a8f71a01babd6c535dff02551

    • Size

      1016KB

    • MD5

      609b54ca07635ba7e209cf42f5d0cc30

    • SHA1

      c775eacbd0ab15c470539a7b31de5b4c3ef8f107

    • SHA256

      35368856dd498b5c4a2f57ea205316db7278a11a8f71a01babd6c535dff02551

    • SHA512

      605ec6ba9cbddbc4850a2a5fbc4e38c63a653a4f7bd6728bb203f711e16f367b4b80ec4aaf94810351351ad46137e86d023d23af61b54d2c85bf0fba8bd7be7d

    • SSDEEP

      6144:lIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:lIXsgtvm1De5YlOx6lzBH46Umu1q

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks