Overview

overview

10

Static

static

d7ce5a6c2d...d0.exe

windows7-x64

10

d7ce5a6c2d...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7ce5a6c2d6075a801a4af765dc3e528cf371dc3b05aae249ba3d2433ec5bbd0

  • Size

    120KB

  • Sample

    221123-s8dpgagd3w

  • MD5

    51f86c354e4ab979d95fecb94d3b0b70

  • SHA1

    d1179bc4eda4552d3f45a33e9de961ce557eeefe

  • SHA256

    d7ce5a6c2d6075a801a4af765dc3e528cf371dc3b05aae249ba3d2433ec5bbd0

  • SHA512

    b3f89b2c5b740733808432edb6f63b7424a968a0537fcaa7d207326cce8214ecce29ed384b65303ab2dc06118459a750f0229b09a1a4a4667bebad57abde1f41

  • SSDEEP

    3072:9rGsyN4JR+uvNs1z2ty21H3rZYi91DbVNKvUb:9YOys3rCinDZF

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      d7ce5a6c2d6075a801a4af765dc3e528cf371dc3b05aae249ba3d2433ec5bbd0

    • Size

      120KB

    • MD5

      51f86c354e4ab979d95fecb94d3b0b70

    • SHA1

      d1179bc4eda4552d3f45a33e9de961ce557eeefe

    • SHA256

      d7ce5a6c2d6075a801a4af765dc3e528cf371dc3b05aae249ba3d2433ec5bbd0

    • SHA512

      b3f89b2c5b740733808432edb6f63b7424a968a0537fcaa7d207326cce8214ecce29ed384b65303ab2dc06118459a750f0229b09a1a4a4667bebad57abde1f41

    • SSDEEP

      3072:9rGsyN4JR+uvNs1z2ty21H3rZYi91DbVNKvUb:9YOys3rCinDZF

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks