Overview

overview

10

Static

static

1122507cbf...65.exe

windows7-x64

10

1122507cbf...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065

  • Size

    181KB

  • Sample

    221123-vnc9bahe36

  • MD5

    068ed81b7b7a3426f0f6292e4f41acd2

  • SHA1

    031cca397819188b38482717d254dcd09dbcc9e6

  • SHA256

    1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065

  • SHA512

    a14e0036ee722b72ad4db3c84e0d06328ced0fecb3c883a735df8ab1bcc68ee2ec825351a46815b5ddcf12aa7439d8a892dabb7a5d7c637718fb6c03c263bcde

  • SSDEEP

    3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQKhsaR2:gDCwfG1bnxLERR9saR2

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065

    • Size

      181KB

    • MD5

      068ed81b7b7a3426f0f6292e4f41acd2

    • SHA1

      031cca397819188b38482717d254dcd09dbcc9e6

    • SHA256

      1122507cbf55f5e6cc356367c9a49aea506b8ff711978936a2f0431859fd6065

    • SHA512

      a14e0036ee722b72ad4db3c84e0d06328ced0fecb3c883a735df8ab1bcc68ee2ec825351a46815b5ddcf12aa7439d8a892dabb7a5d7c637718fb6c03c263bcde

    • SSDEEP

      3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQKhsaR2:gDCwfG1bnxLERR9saR2

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks