Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc081ae799c663668e679680b8aa7ff825458beff211d0be1848b96905a31124

  • Size

    9.7MB

  • Sample

    221027-fejmeaaga6

  • MD5

    bcdf12044dc371543ed7b14c4bf8a586

  • SHA1

    4cb4b2b5978500d17526cbd238717781249a023c

  • SHA256

    fc081ae799c663668e679680b8aa7ff825458beff211d0be1848b96905a31124

  • SHA512

    c95bad64458fe6bb80bd94419338d115f580ce6cfb4b89f8fc33ea51b97fcb4bfad7ec0c82914d5ef5152d722f36fe948a135c2261bb0160c6a04c3ccaca3195

  • SSDEEP

    196608:Ie9vBbrDJa8hjX5FEhDUt5D4oJ+zLzfVV:/bZL526HD4Vn

Score
10/10
ta505

Malware Config

Targets

    • Target

      fc081ae799c663668e679680b8aa7ff825458beff211d0be1848b96905a31124

    • Size

      9.7MB

    • MD5

      bcdf12044dc371543ed7b14c4bf8a586

    • SHA1

      4cb4b2b5978500d17526cbd238717781249a023c

    • SHA256

      fc081ae799c663668e679680b8aa7ff825458beff211d0be1848b96905a31124

    • SHA512

      c95bad64458fe6bb80bd94419338d115f580ce6cfb4b89f8fc33ea51b97fcb4bfad7ec0c82914d5ef5152d722f36fe948a135c2261bb0160c6a04c3ccaca3195

    • SSDEEP

      196608:Ie9vBbrDJa8hjX5FEhDUt5D4oJ+zLzfVV:/bZL526HD4Vn

    Score
    10/10
    ta505

    • TA505

      Cybercrime group active since 2015, responsible for families like Dridex and Locky.

      ta505

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks