Overview

overview

8

Static

static

5

ac17cdb8ca...1c.exe

windows7-x64

8

ac17cdb8ca...1c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac17cdb8ca4f8294c9037067030d6af2700e7e4581c0970194ddae36e7574d1c

  • Size

    693KB

  • Sample

    221106-tnmmbacggp

  • MD5

    2052ab705ccfa85fb5774b37270da426

  • SHA1

    e0b698e165da8097f7ee8e691d98ae0e11b09c66

  • SHA256

    ac17cdb8ca4f8294c9037067030d6af2700e7e4581c0970194ddae36e7574d1c

  • SHA512

    8e6bd8f363503189ee9557f1eaf204ae4d488392c65aef72209b996727be4612bb5131144da555baca0372b359de849a89d241192774b622ad29c1655700bb05

  • SSDEEP

    12288:AhkDgouVr2nxKkorvdRgQriDwOIxmxiZnYQE7PJc74a+jRfc3D:IRRJkcoQricOIQxiZY1pa+Jc3D

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      ac17cdb8ca4f8294c9037067030d6af2700e7e4581c0970194ddae36e7574d1c

    • Size

      693KB

    • MD5

      2052ab705ccfa85fb5774b37270da426

    • SHA1

      e0b698e165da8097f7ee8e691d98ae0e11b09c66

    • SHA256

      ac17cdb8ca4f8294c9037067030d6af2700e7e4581c0970194ddae36e7574d1c

    • SHA512

      8e6bd8f363503189ee9557f1eaf204ae4d488392c65aef72209b996727be4612bb5131144da555baca0372b359de849a89d241192774b622ad29c1655700bb05

    • SSDEEP

      12288:AhkDgouVr2nxKkorvdRgQriDwOIxmxiZnYQE7PJc74a+jRfc3D:IRRJkcoQricOIQxiZY1pa+Jc3D

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks