Overview

overview

10

Static

static

83fb78d5f0...82.exe

windows7-x64

10

83fb78d5f0...82.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

  • Size

    600KB

  • Sample

    221011-kw6kqafccj

  • MD5

    5a50497a16f62ecabbbf0baddf2c6730

  • SHA1

    51bff4da617ba0eed283ee3103500faa4cca0813

  • SHA256

    83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

  • SHA512

    f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

  • SSDEEP

    12288:lpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsxoFS:lpUNr6YkVRFkgbeqeo68Fhq8oFS

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

    • Size

      600KB

    • MD5

      5a50497a16f62ecabbbf0baddf2c6730

    • SHA1

      51bff4da617ba0eed283ee3103500faa4cca0813

    • SHA256

      83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

    • SHA512

      f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

    • SSDEEP

      12288:lpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsxoFS:lpUNr6YkVRFkgbeqeo68Fhq8oFS

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks