Overview

overview

10

Static

static

581d1f7ae1...ff.exe

windows7-x64

8

581d1f7ae1...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    581d1f7ae1d329cf7805dbae694535f673b1ac9f875fddfa0543d6ea696151ff

  • Size

    388KB

  • Sample

    221011-swmrlscabj

  • MD5

    18dffd2bf006851840e94917bc3b6360

  • SHA1

    64ac0c415fc431a899b6a650121834a1d82766e5

  • SHA256

    581d1f7ae1d329cf7805dbae694535f673b1ac9f875fddfa0543d6ea696151ff

  • SHA512

    3aa3a1e5e714c1ebb183cd4ed5960ab3076c1c107467454d4821d99c56cffa71e83c8ff9fc0e91f2c424812f339f2b688db7c745b2ce6998156f08097f67065d

  • SSDEEP

    6144:QgSaGD36TE5kVFlYerDOyT5MDZCu7hCx99sd6+ZXfx7u2GT6zQBui6MOoJ7nc:QY4q7jjvGDZCuw99m7XfVGTGQwi6u7c

Score
10/10
persistence

Malware Config

Targets

    • Target

      581d1f7ae1d329cf7805dbae694535f673b1ac9f875fddfa0543d6ea696151ff

    • Size

      388KB

    • MD5

      18dffd2bf006851840e94917bc3b6360

    • SHA1

      64ac0c415fc431a899b6a650121834a1d82766e5

    • SHA256

      581d1f7ae1d329cf7805dbae694535f673b1ac9f875fddfa0543d6ea696151ff

    • SHA512

      3aa3a1e5e714c1ebb183cd4ed5960ab3076c1c107467454d4821d99c56cffa71e83c8ff9fc0e91f2c424812f339f2b688db7c745b2ce6998156f08097f67065d

    • SSDEEP

      6144:QgSaGD36TE5kVFlYerDOyT5MDZCu7hCx99sd6+ZXfx7u2GT6zQBui6MOoJ7nc:QY4q7jjvGDZCuw99m7XfVGTGQwi6u7c

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks