Overview

overview

10

Static

static

a8beeab1b6...dd.exe

windows7-x64

10

a8beeab1b6...dd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a8beeab1b62c20e7c3188e923c60017b2573ab4c257e22503c2133968efd60dd

  • Size

    320KB

  • Sample

    221106-sbj5zsadcr

  • MD5

    005a118ee57ef05180252398693a90c6

  • SHA1

    4895f77495f0e4f888d761d87a9a3cf1072572aa

  • SHA256

    a8beeab1b62c20e7c3188e923c60017b2573ab4c257e22503c2133968efd60dd

  • SHA512

    c716c6b0c16b61130e89899c8a71c112fe8a9a1c0f044f346baa8ba13f2d4dc4632f4ed9f46f239c6ae554e980f00507012f0be228189f068774a429b1396cd5

  • SSDEEP

    6144:CTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:MXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      a8beeab1b62c20e7c3188e923c60017b2573ab4c257e22503c2133968efd60dd

    • Size

      320KB

    • MD5

      005a118ee57ef05180252398693a90c6

    • SHA1

      4895f77495f0e4f888d761d87a9a3cf1072572aa

    • SHA256

      a8beeab1b62c20e7c3188e923c60017b2573ab4c257e22503c2133968efd60dd

    • SHA512

      c716c6b0c16b61130e89899c8a71c112fe8a9a1c0f044f346baa8ba13f2d4dc4632f4ed9f46f239c6ae554e980f00507012f0be228189f068774a429b1396cd5

    • SSDEEP

      6144:CTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:MXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks