Overview

overview

8

Static

static

336b1661b6...f7.exe

windows7-x64

8

336b1661b6...f7.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    336b1661b66a240f252fdd6b53a43be92793e834945ac9e9eca475ea86b43ff7

  • Size

    260KB

  • Sample

    221011-ry7dcsadap

  • MD5

    690e1920cf7edb4f2d66685745f2e710

  • SHA1

    f7d730f09c6fead005001e7c34902667e7400032

  • SHA256

    336b1661b66a240f252fdd6b53a43be92793e834945ac9e9eca475ea86b43ff7

  • SHA512

    9482f72c71516fc474e95931f8f8948a603f0b12f48a6ec6f2e0092c32caef0590ed2c527dddecd6cb3bac4c4fd84f76f4e091bb4641ef205637981f0b3e435f

  • SSDEEP

    3072:TezGZqJUcQUPU8xnxRIGLP9pMfs7ufRJRUz7hwfiiQJV3L58MrxO:TeiZLeU8xUegfRDfsJV3KM

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      336b1661b66a240f252fdd6b53a43be92793e834945ac9e9eca475ea86b43ff7

    • Size

      260KB

    • MD5

      690e1920cf7edb4f2d66685745f2e710

    • SHA1

      f7d730f09c6fead005001e7c34902667e7400032

    • SHA256

      336b1661b66a240f252fdd6b53a43be92793e834945ac9e9eca475ea86b43ff7

    • SHA512

      9482f72c71516fc474e95931f8f8948a603f0b12f48a6ec6f2e0092c32caef0590ed2c527dddecd6cb3bac4c4fd84f76f4e091bb4641ef205637981f0b3e435f

    • SSDEEP

      3072:TezGZqJUcQUPU8xnxRIGLP9pMfs7ufRJRUz7hwfiiQJV3L58MrxO:TeiZLeU8xUegfRDfsJV3KM

    Score
    8/10
    evasionpersistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks