Overview

overview

10

Static

static

e95a357d4a...6e.exe

windows7-x64

10

e95a357d4a...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e95a357d4a98a142c6aff7cceebf30e7609598e7fc2df438ce28f845e698c66e

  • Size

    356KB

  • Sample

    221123-s1s47acg43

  • MD5

    e958a43a86061daa72ab90f329202e8d

  • SHA1

    b81295939daba113e913f7127440997ea7c4d628

  • SHA256

    e95a357d4a98a142c6aff7cceebf30e7609598e7fc2df438ce28f845e698c66e

  • SHA512

    1cfbd5590580c3263b6ea16e0dbe747d9028a21fd542a04c581b9f60aca5596142984989cc14063289d2fb94f643c400d91bb73e49aabbae2bdc0d5a65dbae70

  • SSDEEP

    6144:uaSHOfZ/4nqhUdbuR+jpyTkxYaYzC+/9pAPLPFk1w26HJdM8:AO4qhayRggT1VzVoJkT6pdM

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      e95a357d4a98a142c6aff7cceebf30e7609598e7fc2df438ce28f845e698c66e

    • Size

      356KB

    • MD5

      e958a43a86061daa72ab90f329202e8d

    • SHA1

      b81295939daba113e913f7127440997ea7c4d628

    • SHA256

      e95a357d4a98a142c6aff7cceebf30e7609598e7fc2df438ce28f845e698c66e

    • SHA512

      1cfbd5590580c3263b6ea16e0dbe747d9028a21fd542a04c581b9f60aca5596142984989cc14063289d2fb94f643c400d91bb73e49aabbae2bdc0d5a65dbae70

    • SSDEEP

      6144:uaSHOfZ/4nqhUdbuR+jpyTkxYaYzC+/9pAPLPFk1w26HJdM8:AO4qhayRggT1VzVoJkT6pdM

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks