Overview

overview

8

Static

static

f489c4ec8f...a4.exe

windows7-x64

8

f489c4ec8f...a4.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f489c4ec8f3b5a4e165d84d5b249eddb04054ad96628ef0867ae992309b435a4

  • Size

    148KB

  • Sample

    221121-sk4kzseh97

  • MD5

    00f2500cb259f8bc1f00106a970846a0

  • SHA1

    bbc91326fa035822a1c806f989fbf89ea6655b9c

  • SHA256

    f489c4ec8f3b5a4e165d84d5b249eddb04054ad96628ef0867ae992309b435a4

  • SHA512

    239ef5290636549bd379f4c363f38a800b3c547c2ae96322b678f5e56e5ab34de3f2072bfe4805d25e2bc2365ab9cf8e297405eea8f19b4a123badc1d64ff703

  • SSDEEP

    1536:Cwsw9ukAf70iXoLSMwa0JKHRpsjmH/78vP+1H5A6jYHHwBj:/swXFiXoLSZJ8sjo8+1Hq6V

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      f489c4ec8f3b5a4e165d84d5b249eddb04054ad96628ef0867ae992309b435a4

    • Size

      148KB

    • MD5

      00f2500cb259f8bc1f00106a970846a0

    • SHA1

      bbc91326fa035822a1c806f989fbf89ea6655b9c

    • SHA256

      f489c4ec8f3b5a4e165d84d5b249eddb04054ad96628ef0867ae992309b435a4

    • SHA512

      239ef5290636549bd379f4c363f38a800b3c547c2ae96322b678f5e56e5ab34de3f2072bfe4805d25e2bc2365ab9cf8e297405eea8f19b4a123badc1d64ff703

    • SSDEEP

      1536:Cwsw9ukAf70iXoLSMwa0JKHRpsjmH/78vP+1H5A6jYHHwBj:/swXFiXoLSZJ8sjo8+1Hq6V

    Score
    8/10
    evasionpersistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks