Overview

overview

8

Static

static

1fcee26efd...a3.exe

windows7-x64

8

1fcee26efd...a3.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1fcee26efde705ae6663ec3393babdaae4390713c976be2233f18348a61c1ca3

  • Size

    152KB

  • Sample

    221121-slps8afa33

  • MD5

    34d8e1c9a7ea237eab2f8ef11a57b96c

  • SHA1

    2a792ffe934df739ef4b9b2a00214e2e18af7f10

  • SHA256

    1fcee26efde705ae6663ec3393babdaae4390713c976be2233f18348a61c1ca3

  • SHA512

    a8f347c8e905da121231c8d8bc711ffc394c8981015e22a145233cf4d1438e19581aa33238040f9f85a9892fb7b53a58ce9e2031229c975fc8cf80f36dc8a833

  • SSDEEP

    1536:tTwBjGkOuG5tLMwZswXi5jVchT8cuvgTfD/ay53Ma3QrAjw9:mDG5tLTZevc7IgrD/ayNU

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      1fcee26efde705ae6663ec3393babdaae4390713c976be2233f18348a61c1ca3

    • Size

      152KB

    • MD5

      34d8e1c9a7ea237eab2f8ef11a57b96c

    • SHA1

      2a792ffe934df739ef4b9b2a00214e2e18af7f10

    • SHA256

      1fcee26efde705ae6663ec3393babdaae4390713c976be2233f18348a61c1ca3

    • SHA512

      a8f347c8e905da121231c8d8bc711ffc394c8981015e22a145233cf4d1438e19581aa33238040f9f85a9892fb7b53a58ce9e2031229c975fc8cf80f36dc8a833

    • SSDEEP

      1536:tTwBjGkOuG5tLMwZswXi5jVchT8cuvgTfD/ay53Ma3QrAjw9:mDG5tLTZevc7IgrD/ayNU

    Score
    8/10
    evasionpersistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks