Overview

overview

10

Static

static

1c0c043af2...d0.exe

windows7-x64

10

1c0c043af2...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0

  • Size

    184KB

  • Sample

    221123-xkq24sfc57

  • MD5

    45b535a3a40d47ef1de18fe1368f5900

  • SHA1

    0f0c5b790f6d65864c8a0d7a88dba24bf7c20ab0

  • SHA256

    1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0

  • SHA512

    1bf527e7f633be040553f8e75621fd3203b2bb431bfd860a567ef89ab1dd453a91f018f40616a3f98713cf91694b1de930f36b276e53a61b151ad56807e44ac6

  • SSDEEP

    3072:u7Ug+HWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEIS3A:Mrpz6LKnvmb7/D26yQlw/Lg5qosri/Sw

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0

    • Size

      184KB

    • MD5

      45b535a3a40d47ef1de18fe1368f5900

    • SHA1

      0f0c5b790f6d65864c8a0d7a88dba24bf7c20ab0

    • SHA256

      1c0c043af28f7e939b97179500fa353d41038d6e4de4da7d45b43470171b79d0

    • SHA512

      1bf527e7f633be040553f8e75621fd3203b2bb431bfd860a567ef89ab1dd453a91f018f40616a3f98713cf91694b1de930f36b276e53a61b151ad56807e44ac6

    • SSDEEP

      3072:u7Ug+HWoYTzCh46Knvmb7/D26ytQlw/Lg5q69srijEIS3A:Mrpz6LKnvmb7/D26yQlw/Lg5qosri/Sw

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks