Overview

overview

10

Static

static

bed01b28a9...67.exe

windows7-x64

10

bed01b28a9...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bed01b28a9fc50ca04a93dc34fbf8dce685fd9d3ab2d4ab6bf5eaac3ee875067

  • Size

    228KB

  • Sample

    221029-twftqsegfr

  • MD5

    a37d043cd7bf16bb3fe436e49ba909fb

  • SHA1

    e34b3b3425c1cc60dbc9c7054f072597d8547fd9

  • SHA256

    bed01b28a9fc50ca04a93dc34fbf8dce685fd9d3ab2d4ab6bf5eaac3ee875067

  • SHA512

    1f684132ea41baf4c8df153c90eb652102f545b9405894b62d128f97663c395125c978746bf989e12466d023e10198a3cfc1afd02086e0adeb04dbff2502c69e

  • SSDEEP

    3072:ugnEui5UYJVFV5eDQHsuvNA05Vqtto24VmcZMUuXi46qndeAxIbYpZB:+d3JrLeDQHr+uV0to24VmlUuSvqEo

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      bed01b28a9fc50ca04a93dc34fbf8dce685fd9d3ab2d4ab6bf5eaac3ee875067

    • Size

      228KB

    • MD5

      a37d043cd7bf16bb3fe436e49ba909fb

    • SHA1

      e34b3b3425c1cc60dbc9c7054f072597d8547fd9

    • SHA256

      bed01b28a9fc50ca04a93dc34fbf8dce685fd9d3ab2d4ab6bf5eaac3ee875067

    • SHA512

      1f684132ea41baf4c8df153c90eb652102f545b9405894b62d128f97663c395125c978746bf989e12466d023e10198a3cfc1afd02086e0adeb04dbff2502c69e

    • SSDEEP

      3072:ugnEui5UYJVFV5eDQHsuvNA05Vqtto24VmcZMUuXi46qndeAxIbYpZB:+d3JrLeDQHr+uV0to24VmlUuSvqEo

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks