Overview

overview

10

Static

static

11c1ba2073...8b.exe

windows7-x64

10

11c1ba2073...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11c1ba20732e3766fad4b2d512576335f03b1d748e6d6e58461d5f70da69d68b

  • Size

    238KB

  • Sample

    221107-w1xzxsebaj

  • MD5

    07b7b3bc960cb41c13bc784d06747a49

  • SHA1

    6cd96f5e4292a239c80033d6b7444d6e9c56d320

  • SHA256

    11c1ba20732e3766fad4b2d512576335f03b1d748e6d6e58461d5f70da69d68b

  • SHA512

    47dd8e3168243cc32c8f5a1bceb0d86d86d7f36e42c343a397c82cbb3301549f1eb49f548f3db1f6d01717a77cbbda590bd67f272d584b99e314b3bcbaa243f6

  • SSDEEP

    3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQyMWoe0c8TilDcq1FG4JDP8Kn:gDCwfG1bnxLERRh5yc8TO91FG4JDPfn

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      11c1ba20732e3766fad4b2d512576335f03b1d748e6d6e58461d5f70da69d68b

    • Size

      238KB

    • MD5

      07b7b3bc960cb41c13bc784d06747a49

    • SHA1

      6cd96f5e4292a239c80033d6b7444d6e9c56d320

    • SHA256

      11c1ba20732e3766fad4b2d512576335f03b1d748e6d6e58461d5f70da69d68b

    • SHA512

      47dd8e3168243cc32c8f5a1bceb0d86d86d7f36e42c343a397c82cbb3301549f1eb49f548f3db1f6d01717a77cbbda590bd67f272d584b99e314b3bcbaa243f6

    • SSDEEP

      3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQyMWoe0c8TilDcq1FG4JDP8Kn:gDCwfG1bnxLERRh5yc8TO91FG4JDPfn

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks