Overview

overview

10

Static

static

227788914e...c0.exe

windows7-x64

10

227788914e...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    227788914ecdc9b1e5b54aa8cd6ff57e04b79e5deb8c4a1951f3be5be0ae7bc0

  • Size

    1016KB

  • Sample

    221123-s9rmqadd63

  • MD5

    5b6e8a6f541a736a36677974605efe20

  • SHA1

    5ae664a82587fe992e1b1a21eb535f8fd89e8ae6

  • SHA256

    227788914ecdc9b1e5b54aa8cd6ff57e04b79e5deb8c4a1951f3be5be0ae7bc0

  • SHA512

    bf9f8dae5674c4d13aa3e8b7c6b7addb79d02550c1d342fce02a47fe15856e3f0cf5883f4e51a12fb2a0bcc8a7bffa262fb7e1910049bcb09633157b1909853c

  • SSDEEP

    6144:VIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUry:VIXsgtvm1De5YlOx6lzBH46Ury

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      227788914ecdc9b1e5b54aa8cd6ff57e04b79e5deb8c4a1951f3be5be0ae7bc0

    • Size

      1016KB

    • MD5

      5b6e8a6f541a736a36677974605efe20

    • SHA1

      5ae664a82587fe992e1b1a21eb535f8fd89e8ae6

    • SHA256

      227788914ecdc9b1e5b54aa8cd6ff57e04b79e5deb8c4a1951f3be5be0ae7bc0

    • SHA512

      bf9f8dae5674c4d13aa3e8b7c6b7addb79d02550c1d342fce02a47fe15856e3f0cf5883f4e51a12fb2a0bcc8a7bffa262fb7e1910049bcb09633157b1909853c

    • SSDEEP

      6144:VIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUry:VIXsgtvm1De5YlOx6lzBH46Ury

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks