Overview

overview

10

Static

static

2e4a6036e1...51.exe

windows7-x64

10

2e4a6036e1...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e4a6036e18bf42a562bee8a5d24086ef19dc7b80d56030e8a79554d880e4d51

  • Size

    961KB

  • Sample

    221030-d27xeabdcl

  • MD5

    844dfc9fa0ee0e20e1831786c9593ea2

  • SHA1

    d6f7027078256fe10ba54e8be0a2a83fc519597e

  • SHA256

    2e4a6036e18bf42a562bee8a5d24086ef19dc7b80d56030e8a79554d880e4d51

  • SHA512

    5f215ef3e31af3054637719a2adfbf260fcdda1b5128df53f353c0714adcf33d838b82c4b09c13e3f80dc0964eb8d0f662ef5b81eaf6ff52c7bafbfc5024b673

  • SSDEEP

    12288:rjS3Yvyn/0TvhifHW8NUnVuCjNHtJsqwhza:ru3Y578NUnV9jNHf11

Score
10/10
persistence

Malware Config

Targets

    • Target

      2e4a6036e18bf42a562bee8a5d24086ef19dc7b80d56030e8a79554d880e4d51

    • Size

      961KB

    • MD5

      844dfc9fa0ee0e20e1831786c9593ea2

    • SHA1

      d6f7027078256fe10ba54e8be0a2a83fc519597e

    • SHA256

      2e4a6036e18bf42a562bee8a5d24086ef19dc7b80d56030e8a79554d880e4d51

    • SHA512

      5f215ef3e31af3054637719a2adfbf260fcdda1b5128df53f353c0714adcf33d838b82c4b09c13e3f80dc0964eb8d0f662ef5b81eaf6ff52c7bafbfc5024b673

    • SSDEEP

      12288:rjS3Yvyn/0TvhifHW8NUnVuCjNHtJsqwhza:ru3Y578NUnV9jNHf11

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks