Overview

overview

10

Static

static

30defbf0e4...9b.exe

windows7-x64

10

30defbf0e4...9b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30defbf0e4d22ae7470f9b8410d2251de2c98895df1b53db033fe499c1e72d9b

  • Size

    1016KB

  • Sample

    221012-swnc5shdb5

  • MD5

    6737e1ad021adf9b3a7012847471d8a0

  • SHA1

    f46dcf3741e5f0444d638e5a67b08dec122e7de0

  • SHA256

    30defbf0e4d22ae7470f9b8410d2251de2c98895df1b53db033fe499c1e72d9b

  • SHA512

    3e942ad0a2d9e5f3c3f050d017fab67cc84369d0681fab77fa05699ad8cbbddbc318403775e8d0ac7fe7dcbaee640fd459b4f1623112de7e41ad9b26db961e6b

  • SSDEEP

    6144:CIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUB:CIXsgtvm1De5YlOx6lzBH46U

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      30defbf0e4d22ae7470f9b8410d2251de2c98895df1b53db033fe499c1e72d9b

    • Size

      1016KB

    • MD5

      6737e1ad021adf9b3a7012847471d8a0

    • SHA1

      f46dcf3741e5f0444d638e5a67b08dec122e7de0

    • SHA256

      30defbf0e4d22ae7470f9b8410d2251de2c98895df1b53db033fe499c1e72d9b

    • SHA512

      3e942ad0a2d9e5f3c3f050d017fab67cc84369d0681fab77fa05699ad8cbbddbc318403775e8d0ac7fe7dcbaee640fd459b4f1623112de7e41ad9b26db961e6b

    • SSDEEP

      6144:CIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUB:CIXsgtvm1De5YlOx6lzBH46U

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks