Overview

overview

10

Static

static

06c71ee655...80.exe

windows7-x64

10

06c71ee655...80.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    06c71ee655840ef15215c308ceef568e336a4879686d5636e365c27a499f7480

  • Size

    128KB

  • Sample

    221029-tn7mgsdgc2

  • MD5

    83e848920dabd72bb72c6cbd3a29982b

  • SHA1

    d8daf9110960f7ea2322c9a79ebc0ac2cae08cbd

  • SHA256

    06c71ee655840ef15215c308ceef568e336a4879686d5636e365c27a499f7480

  • SHA512

    9d47f3680dd89eb33c5ba06883cf0df50e30e5a0b6899e3ece2a8e44aee0bde19df4a8ce05799edaf14c2f50b4c2beb8e921b4b0feef4da747b6c629d214531c

  • SSDEEP

    3072:yrXcplToPac4lUKjxcnz/Lj3UtDzkknldlTlIvLD:yrcplToSUacnz/Lj3U9wOlGD

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      06c71ee655840ef15215c308ceef568e336a4879686d5636e365c27a499f7480

    • Size

      128KB

    • MD5

      83e848920dabd72bb72c6cbd3a29982b

    • SHA1

      d8daf9110960f7ea2322c9a79ebc0ac2cae08cbd

    • SHA256

      06c71ee655840ef15215c308ceef568e336a4879686d5636e365c27a499f7480

    • SHA512

      9d47f3680dd89eb33c5ba06883cf0df50e30e5a0b6899e3ece2a8e44aee0bde19df4a8ce05799edaf14c2f50b4c2beb8e921b4b0feef4da747b6c629d214531c

    • SSDEEP

      3072:yrXcplToPac4lUKjxcnz/Lj3UtDzkknldlTlIvLD:yrcplToSUacnz/Lj3U9wOlGD

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks