Overview

overview

10

Static

static

3c88b9ff58...a4.exe

windows7-x64

10

3c88b9ff58...a4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c88b9ff5818231a495231b7a906ff6c285a377e3ba16e95026fbe59fcd3e5a4

  • Size

    262KB

  • Sample

    221030-yv8wcahhak

  • MD5

    a0ab1c05677ac2ea5841128669c03400

  • SHA1

    796ad804fd080d0e4242fd7cc4cbf09d26e5bf31

  • SHA256

    3c88b9ff5818231a495231b7a906ff6c285a377e3ba16e95026fbe59fcd3e5a4

  • SHA512

    04b49dfd7e4c0eeb7aa73756e3ff7129d160a9cdb9f74fb3f31fcd7155aaad8c4edb8862e25850e770093c83225d88e17b250f118432927e0d987356a53506d3

  • SSDEEP

    6144:5xuthxNhVpcVmcOClV7cN1kyymJuc4E8O:5xcPiIAZdO

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      3c88b9ff5818231a495231b7a906ff6c285a377e3ba16e95026fbe59fcd3e5a4

    • Size

      262KB

    • MD5

      a0ab1c05677ac2ea5841128669c03400

    • SHA1

      796ad804fd080d0e4242fd7cc4cbf09d26e5bf31

    • SHA256

      3c88b9ff5818231a495231b7a906ff6c285a377e3ba16e95026fbe59fcd3e5a4

    • SHA512

      04b49dfd7e4c0eeb7aa73756e3ff7129d160a9cdb9f74fb3f31fcd7155aaad8c4edb8862e25850e770093c83225d88e17b250f118432927e0d987356a53506d3

    • SSDEEP

      6144:5xuthxNhVpcVmcOClV7cN1kyymJuc4E8O:5xcPiIAZdO

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks