Overview

overview

10

Static

static

b358deef00...c2.exe

windows7-x64

10

b358deef00...c2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b358deef00c98156a586cf071374082f15d6fc7a9433f98ed4e15364061947c2

  • Size

    136KB

  • Sample

    221106-jj1chacgfp

  • MD5

    31d44d0662ad212386f3792a0dc4b950

  • SHA1

    2780e26bb05d4fe31189c8771306c497735a0985

  • SHA256

    b358deef00c98156a586cf071374082f15d6fc7a9433f98ed4e15364061947c2

  • SHA512

    089a1e1cd550108ee10cd3fc2fad4238162f9364b172446a3434d1f77481e6f0113f2cdcfcd65a07d1f48e1e475c8d78d3d3543c53ab79385697cdc10563bd73

  • SSDEEP

    3072:VoJXqMEE9cle6hAstpKFLtki51KhhH5dRp8Kif:+J6MENRtEhYhhZdLif

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      b358deef00c98156a586cf071374082f15d6fc7a9433f98ed4e15364061947c2

    • Size

      136KB

    • MD5

      31d44d0662ad212386f3792a0dc4b950

    • SHA1

      2780e26bb05d4fe31189c8771306c497735a0985

    • SHA256

      b358deef00c98156a586cf071374082f15d6fc7a9433f98ed4e15364061947c2

    • SHA512

      089a1e1cd550108ee10cd3fc2fad4238162f9364b172446a3434d1f77481e6f0113f2cdcfcd65a07d1f48e1e475c8d78d3d3543c53ab79385697cdc10563bd73

    • SSDEEP

      3072:VoJXqMEE9cle6hAstpKFLtki51KhhH5dRp8Kif:+J6MENRtEhYhhZdLif

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks