Resubmissions

01-12-2022 16:45

221201-t9cz1acb3x 10

11-11-2022 18:32

221111-w6lh3scf3v 8

General

  • Target

    2ae3a0c040d6570d55d82d06f3d31584.exe

  • Size

    41KB

  • Sample

    221111-w6lh3scf3v

  • MD5

    2ae3a0c040d6570d55d82d06f3d31584

  • SHA1

    e69f8b020a5ea66426f00458c535b2f0ce336329

  • SHA256

    20d023d654dba4e16ec122b6339633eea418652a30d599a8c4a9bc3698d26b46

  • SHA512

    d87b5cd1c1e9c5c7c1a188f3abceba227035e1b2a8ceba7861e0d5f415868c21d75db5af9808d396a50c5e13e9a42534bd5630caa6869a3d658a2982db24d48d

  • SSDEEP

    768:eOQvBUsvIsEaxV0h/L9/1rsQhLOSyoZV65:eXlAbCGL9/x1OSZZV65

Score
8/10

Malware Config

Targets

    • Target

      2ae3a0c040d6570d55d82d06f3d31584.exe

    • Size

      41KB

    • MD5

      2ae3a0c040d6570d55d82d06f3d31584

    • SHA1

      e69f8b020a5ea66426f00458c535b2f0ce336329

    • SHA256

      20d023d654dba4e16ec122b6339633eea418652a30d599a8c4a9bc3698d26b46

    • SHA512

      d87b5cd1c1e9c5c7c1a188f3abceba227035e1b2a8ceba7861e0d5f415868c21d75db5af9808d396a50c5e13e9a42534bd5630caa6869a3d658a2982db24d48d

    • SSDEEP

      768:eOQvBUsvIsEaxV0h/L9/1rsQhLOSyoZV65:eXlAbCGL9/x1OSZZV65

    Score
    8/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks