Overview

overview

10

Static

static

99da589fdc...0e.exe

windows7-x64

10

99da589fdc...0e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    99da589fdc02aa9d7d6b38c08bdec0935142d92434a3f263405dff7a4f22e20e

  • Size

    324KB

  • Sample

    221030-a7a8vaehel

  • MD5

    930888edc9d1b200439f6d6c3d46d98f

  • SHA1

    835f1a4b3bfa0c7d1a0a910dae3e1290b37a82ab

  • SHA256

    99da589fdc02aa9d7d6b38c08bdec0935142d92434a3f263405dff7a4f22e20e

  • SHA512

    d29cf28fc0f7f272fecfdeb51fc2f49b37d7b6dfbd2dc192f3e1cd56c83c368c4a71b4d5ba7a116de30865df69b1beee45e850bd7f25adcef03f0f898f2ea261

  • SSDEEP

    3072:6BNmGSGtGSGOGOGlGln+VP/m8ClX0kUb+16H6b5p8I0yH/JN8HOWShM+L7aL7rBz:6+bELf/Ml/cWdi5pV/JNWOVhM+JI

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      99da589fdc02aa9d7d6b38c08bdec0935142d92434a3f263405dff7a4f22e20e

    • Size

      324KB

    • MD5

      930888edc9d1b200439f6d6c3d46d98f

    • SHA1

      835f1a4b3bfa0c7d1a0a910dae3e1290b37a82ab

    • SHA256

      99da589fdc02aa9d7d6b38c08bdec0935142d92434a3f263405dff7a4f22e20e

    • SHA512

      d29cf28fc0f7f272fecfdeb51fc2f49b37d7b6dfbd2dc192f3e1cd56c83c368c4a71b4d5ba7a116de30865df69b1beee45e850bd7f25adcef03f0f898f2ea261

    • SSDEEP

      3072:6BNmGSGtGSGOGOGlGln+VP/m8ClX0kUb+16H6b5p8I0yH/JN8HOWShM+L7aL7rBz:6+bELf/Ml/cWdi5pV/JNWOVhM+JI

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks