Overview

overview

10

Static

static

d8029079a3...ec.exe

windows7-x64

10

d8029079a3...ec.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8029079a391592a141524f5f38abe68e060befba4e9b45aa31cb395d58c1bec

  • Size

    492KB

  • Sample

    221123-3a6mpsbh86

  • MD5

    480658dfb5a6d25391596629de6dbd60

  • SHA1

    b4727fd93adffc3039cbe09ee33ffd19811971ed

  • SHA256

    d8029079a391592a141524f5f38abe68e060befba4e9b45aa31cb395d58c1bec

  • SHA512

    46be371b9056dfc8ebabbc4f1649569d84134b60bf2dd609d7e5fd6708c8cfb5ffba2d333e1fa23a4c9f5dd4201586626f40247f90b02741e15a1f6fb978e19c

  • SSDEEP

    12288:6Kr3QboC9qLGKgZKe4HYpHvcbTRRfMMMMM2MMMMM:6Q3QbiGL8LwHwRfMMMMM2MMMMM

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      d8029079a391592a141524f5f38abe68e060befba4e9b45aa31cb395d58c1bec

    • Size

      492KB

    • MD5

      480658dfb5a6d25391596629de6dbd60

    • SHA1

      b4727fd93adffc3039cbe09ee33ffd19811971ed

    • SHA256

      d8029079a391592a141524f5f38abe68e060befba4e9b45aa31cb395d58c1bec

    • SHA512

      46be371b9056dfc8ebabbc4f1649569d84134b60bf2dd609d7e5fd6708c8cfb5ffba2d333e1fa23a4c9f5dd4201586626f40247f90b02741e15a1f6fb978e19c

    • SSDEEP

      12288:6Kr3QboC9qLGKgZKe4HYpHvcbTRRfMMMMM2MMMMM:6Q3QbiGL8LwHwRfMMMMM2MMMMM

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks