Overview

overview

8

Static

static

c67d1d60e9...38.exe

windows7-x64

8

c67d1d60e9...38.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c67d1d60e9c9df329b3305823bb86f9ca06240f5f1d08d11e5bef5d30ac5d538

  • Size

    750KB

  • Sample

    221123-l4rxzada73

  • MD5

    9d6fd7dc4f96fff0534b1359eecaeacc

  • SHA1

    e16116d254b2e0ef49d26fb5fb04f44272963d27

  • SHA256

    c67d1d60e9c9df329b3305823bb86f9ca06240f5f1d08d11e5bef5d30ac5d538

  • SHA512

    09923f8ceeb8a6a53dbfb83201bb1d493a2e0a74715ea969cd35b9ba7ac0370eab5c22ccd713c7f775c7138e4371f88cce8c717b36bff0ca2bee40aacaa9a63d

  • SSDEEP

    12288:cyr7r4GeadGrukA67OKWHKUzhxEfYrKxT5Jx+CMuicLp0MicMwk9FbBbA:ciVWSVKyjEBxFCap0Zwk9FbS

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      c67d1d60e9c9df329b3305823bb86f9ca06240f5f1d08d11e5bef5d30ac5d538

    • Size

      750KB

    • MD5

      9d6fd7dc4f96fff0534b1359eecaeacc

    • SHA1

      e16116d254b2e0ef49d26fb5fb04f44272963d27

    • SHA256

      c67d1d60e9c9df329b3305823bb86f9ca06240f5f1d08d11e5bef5d30ac5d538

    • SHA512

      09923f8ceeb8a6a53dbfb83201bb1d493a2e0a74715ea969cd35b9ba7ac0370eab5c22ccd713c7f775c7138e4371f88cce8c717b36bff0ca2bee40aacaa9a63d

    • SSDEEP

      12288:cyr7r4GeadGrukA67OKWHKUzhxEfYrKxT5Jx+CMuicLp0MicMwk9FbBbA:ciVWSVKyjEBxFCap0Zwk9FbS

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks