Overview

overview

10

Static

static

660abfaa77...58.exe

windows7-x64

10

660abfaa77...58.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    660abfaa776f2ad8db69d82bbf076d9e773cf7c2ec24b8246fe47ac303569658

  • Size

    1016KB

  • Sample

    221030-g79vqsgfcq

  • MD5

    928e5ae49d212720359baa5f7a310b70

  • SHA1

    d88f71ef69600762a9cd122b4506235bb3d5319d

  • SHA256

    660abfaa776f2ad8db69d82bbf076d9e773cf7c2ec24b8246fe47ac303569658

  • SHA512

    41907f1d2b4c8d77494b21bc0c62dae86a2fc098c67d0375c091ee4272f38048a69ea658b7a1b16d8c8fb98fcb362ef60e1bd497fd19d9d5856273fbc98454b9

  • SSDEEP

    6144:2IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:2IXsgtvm1De5YlOx6lzBH46U

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      660abfaa776f2ad8db69d82bbf076d9e773cf7c2ec24b8246fe47ac303569658

    • Size

      1016KB

    • MD5

      928e5ae49d212720359baa5f7a310b70

    • SHA1

      d88f71ef69600762a9cd122b4506235bb3d5319d

    • SHA256

      660abfaa776f2ad8db69d82bbf076d9e773cf7c2ec24b8246fe47ac303569658

    • SHA512

      41907f1d2b4c8d77494b21bc0c62dae86a2fc098c67d0375c091ee4272f38048a69ea658b7a1b16d8c8fb98fcb362ef60e1bd497fd19d9d5856273fbc98454b9

    • SSDEEP

      6144:2IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:2IXsgtvm1De5YlOx6lzBH46U

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks