Overview

overview

10

Static

static

509a4104ad...57.exe

windows7-x64

10

509a4104ad...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    509a4104ad505a674b03ee8b7dd734431334102f1c1dc79e53ce28549d7ef857

  • Size

    340KB

  • Sample

    221107-wz3h1sbfe9

  • MD5

    0f98b71ceccfe7b70b6bdfa8be22daae

  • SHA1

    6ae2968777eabe28ed20e319ee194b9dc6ebb419

  • SHA256

    509a4104ad505a674b03ee8b7dd734431334102f1c1dc79e53ce28549d7ef857

  • SHA512

    e3fc402bd034713db5da24bdeec5a397f047966259d0ffa80d6e4548fdf8356dd8b1008e571a091c7d007f3d5a1bd31531e3825a37a4dd40cb652d6251ab43f2

  • SSDEEP

    3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQabpDCw1p3vmLvsZIaVwiwDcIbDY:gDCwfG1bnxLERRDDCwfG1bnxLERR/

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      509a4104ad505a674b03ee8b7dd734431334102f1c1dc79e53ce28549d7ef857

    • Size

      340KB

    • MD5

      0f98b71ceccfe7b70b6bdfa8be22daae

    • SHA1

      6ae2968777eabe28ed20e319ee194b9dc6ebb419

    • SHA256

      509a4104ad505a674b03ee8b7dd734431334102f1c1dc79e53ce28549d7ef857

    • SHA512

      e3fc402bd034713db5da24bdeec5a397f047966259d0ffa80d6e4548fdf8356dd8b1008e571a091c7d007f3d5a1bd31531e3825a37a4dd40cb652d6251ab43f2

    • SSDEEP

      3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQabpDCw1p3vmLvsZIaVwiwDcIbDY:gDCwfG1bnxLERRDDCwfG1bnxLERR/

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks