Overview

overview

10

Static

static

5ebd8a959c...c0.exe

windows7-x64

10

5ebd8a959c...c0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5ebd8a959ccbfdd47cb61faf7fd47b585351b7b9c3543401267dbc6521b1dcc0

  • Size

    171KB

  • Sample

    221028-w6ny7sahbn

  • MD5

    0bc31f8223ff0e0cb56ebae17f220da0

  • SHA1

    e85343903132db3252eff10c1b51af4256a1544f

  • SHA256

    5ebd8a959ccbfdd47cb61faf7fd47b585351b7b9c3543401267dbc6521b1dcc0

  • SHA512

    4f30a8f4890340d3b91d4c1cdffc9e7631dd07f4c621e918a40a77320f759fed501b36361504333d2522088a1c6db59033e09395b1bf481e47aa6e834766abd6

  • SSDEEP

    3072:D/iS57XjRb4mY1LN+YMeJq3c/fc9MyxrEVdcHc09ARsJ1V826e9E3yQXvBKq+v:h5rjef1L8ms9mUkRsYMefpKqO

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      5ebd8a959ccbfdd47cb61faf7fd47b585351b7b9c3543401267dbc6521b1dcc0

    • Size

      171KB

    • MD5

      0bc31f8223ff0e0cb56ebae17f220da0

    • SHA1

      e85343903132db3252eff10c1b51af4256a1544f

    • SHA256

      5ebd8a959ccbfdd47cb61faf7fd47b585351b7b9c3543401267dbc6521b1dcc0

    • SHA512

      4f30a8f4890340d3b91d4c1cdffc9e7631dd07f4c621e918a40a77320f759fed501b36361504333d2522088a1c6db59033e09395b1bf481e47aa6e834766abd6

    • SSDEEP

      3072:D/iS57XjRb4mY1LN+YMeJq3c/fc9MyxrEVdcHc09ARsJ1V826e9E3yQXvBKq+v:h5rjef1L8ms9mUkRsYMefpKqO

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks