Overview

overview

10

Static

static

66d78d6638...f1.exe

windows7-x64

10

66d78d6638...f1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    66d78d66382f3cae0ac8986a5b747665bf62416eaebc1265676727bc32483bf1

  • Size

    220KB

  • Sample

    221029-tlkd6sedaj

  • MD5

    83e2ce7016c8e4ed2429a19881495330

  • SHA1

    4d347a854be19a5f1dc1f1dc2df2cea9b0638cbd

  • SHA256

    66d78d66382f3cae0ac8986a5b747665bf62416eaebc1265676727bc32483bf1

  • SHA512

    bd404fd0ba5ddb8fd6af7043443706096cebc13e2bf8247b85a4a0289f2e1b8f00c15a5aa6abfd46dddf976d231a2e75c0e720fca437345599c3c4ff7800c193

  • SSDEEP

    6144:t1vbkGTN13hpSkp+auNGo0hIv9SDlMbYEUq3sfaJZwd8YAks61SMJnxINMM8Jull:tlbTTN13hpSkfuNG3hIv9SDlMb5Uq3sa

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      66d78d66382f3cae0ac8986a5b747665bf62416eaebc1265676727bc32483bf1

    • Size

      220KB

    • MD5

      83e2ce7016c8e4ed2429a19881495330

    • SHA1

      4d347a854be19a5f1dc1f1dc2df2cea9b0638cbd

    • SHA256

      66d78d66382f3cae0ac8986a5b747665bf62416eaebc1265676727bc32483bf1

    • SHA512

      bd404fd0ba5ddb8fd6af7043443706096cebc13e2bf8247b85a4a0289f2e1b8f00c15a5aa6abfd46dddf976d231a2e75c0e720fca437345599c3c4ff7800c193

    • SSDEEP

      6144:t1vbkGTN13hpSkp+auNGo0hIv9SDlMbYEUq3sfaJZwd8YAks61SMJnxINMM8Jull:tlbTTN13hpSkfuNG3hIv9SDlMb5Uq3sa

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks