Overview

overview

10

Static

static

de54c688af...88.exe

windows7-x64

10

de54c688af...88.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    de54c688af8f2b9f24423161e156bdad05fd5fcc74c4fe1a9fca9b21ef709488

  • Size

    126KB

  • Sample

    221011-ssbvyabgek

  • MD5

    68988100329b17da6dd70917e18fb962

  • SHA1

    6298e6f52448b8cc440f8d9f6de9301db34b38d3

  • SHA256

    de54c688af8f2b9f24423161e156bdad05fd5fcc74c4fe1a9fca9b21ef709488

  • SHA512

    2e8ca5ce158e891774ec71bba8ed02688be22a6d727e8630f00535ceef9f98d485c5d545a3686f782b5d57acbe491c31662d7bdf1b0d9a266c6e4899ef85cbf4

  • SSDEEP

    3072:IrmaiaKsjtJ7YGiHiVchuT4ghw+uSs0xpEc3B:X2RjtFYGiScoK+uSsSEi

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      de54c688af8f2b9f24423161e156bdad05fd5fcc74c4fe1a9fca9b21ef709488

    • Size

      126KB

    • MD5

      68988100329b17da6dd70917e18fb962

    • SHA1

      6298e6f52448b8cc440f8d9f6de9301db34b38d3

    • SHA256

      de54c688af8f2b9f24423161e156bdad05fd5fcc74c4fe1a9fca9b21ef709488

    • SHA512

      2e8ca5ce158e891774ec71bba8ed02688be22a6d727e8630f00535ceef9f98d485c5d545a3686f782b5d57acbe491c31662d7bdf1b0d9a266c6e4899ef85cbf4

    • SSDEEP

      3072:IrmaiaKsjtJ7YGiHiVchuT4ghw+uSs0xpEc3B:X2RjtFYGiScoK+uSsSEi

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks