Overview

overview

10

Static

static

82ad6fef9f...0c.exe

windows7-x64

10

82ad6fef9f...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82ad6fef9f078c052d15c7ff66dc688d37e54ae765e825095d4dab0fe4d1610c

  • Size

    1016KB

  • Sample

    221020-s2wlpscac9

  • MD5

    a0351403f826a4890c8dd16b2a00d560

  • SHA1

    a20810747f56d2bc35003865de25802fae36d240

  • SHA256

    82ad6fef9f078c052d15c7ff66dc688d37e54ae765e825095d4dab0fe4d1610c

  • SHA512

    ca57cf45c1313cb4bf0e5f30ba781a9fbecbd01acd0c05918e7f40f5d02c6b90b4f6c8a1a90253683d47a25c5ce372049d29a29f076ec08832326f9d1ae80611

  • SSDEEP

    6144:1IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUzx84a2lXUW:1IXsgtvm1De5YlOx6lzBH46Uzf7lXUW

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      82ad6fef9f078c052d15c7ff66dc688d37e54ae765e825095d4dab0fe4d1610c

    • Size

      1016KB

    • MD5

      a0351403f826a4890c8dd16b2a00d560

    • SHA1

      a20810747f56d2bc35003865de25802fae36d240

    • SHA256

      82ad6fef9f078c052d15c7ff66dc688d37e54ae765e825095d4dab0fe4d1610c

    • SHA512

      ca57cf45c1313cb4bf0e5f30ba781a9fbecbd01acd0c05918e7f40f5d02c6b90b4f6c8a1a90253683d47a25c5ce372049d29a29f076ec08832326f9d1ae80611

    • SSDEEP

      6144:1IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUzx84a2lXUW:1IXsgtvm1De5YlOx6lzBH46Uzf7lXUW

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks