Overview

overview

10

Static

static

74fffac395...a7.exe

windows7-x64

10

74fffac395...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74fffac395ec26e3bee8dccee011a3215307fe43bb5a0cdf2c32e1328a3938a7

  • Size

    1016KB

  • Sample

    221107-dcwsvagbdr

  • MD5

    088efce33e3437bcd86493a04a59ca50

  • SHA1

    8534b1ad9da1994dc6a428d9e5d43bfa9542e6be

  • SHA256

    74fffac395ec26e3bee8dccee011a3215307fe43bb5a0cdf2c32e1328a3938a7

  • SHA512

    c467a54c3947951930080e972c9267dd00fc51216ed083a9ce09e3273d35d4ec20c749ed527d67c9314f45d727066ed281485e745759abda8eaa77c19080df94

  • SSDEEP

    6144:wIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUPzo0zo:wIXsgtvm1De5YlOx6lzBH46UPzo0zo

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      74fffac395ec26e3bee8dccee011a3215307fe43bb5a0cdf2c32e1328a3938a7

    • Size

      1016KB

    • MD5

      088efce33e3437bcd86493a04a59ca50

    • SHA1

      8534b1ad9da1994dc6a428d9e5d43bfa9542e6be

    • SHA256

      74fffac395ec26e3bee8dccee011a3215307fe43bb5a0cdf2c32e1328a3938a7

    • SHA512

      c467a54c3947951930080e972c9267dd00fc51216ed083a9ce09e3273d35d4ec20c749ed527d67c9314f45d727066ed281485e745759abda8eaa77c19080df94

    • SSDEEP

      6144:wIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUPzo0zo:wIXsgtvm1De5YlOx6lzBH46UPzo0zo

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks