Overview

overview

10

Static

static

eea3c5784f...16.exe

windows7-x64

10

eea3c5784f...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eea3c5784f9715e2e5a161748c22dba09d3b995302287d46a3ce43ffd32e3316

  • Size

    508KB

  • Sample

    221123-z52epahf3z

  • MD5

    15917e7af2771c0408b43b57cffe2e92

  • SHA1

    aaf81b8e20ffecf2b77e5cbe6a0e82f1093ab6c1

  • SHA256

    eea3c5784f9715e2e5a161748c22dba09d3b995302287d46a3ce43ffd32e3316

  • SHA512

    abc10da0b5962f1c77d3cd4175eaacf5e1c9bc5ee1361ce5065ab04e058adafb69a634bd836dfb78a5dc0822f8c839595cd1638d7c05908d93f39e14925ba9e4

  • SSDEEP

    6144:y3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:y3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      eea3c5784f9715e2e5a161748c22dba09d3b995302287d46a3ce43ffd32e3316

    • Size

      508KB

    • MD5

      15917e7af2771c0408b43b57cffe2e92

    • SHA1

      aaf81b8e20ffecf2b77e5cbe6a0e82f1093ab6c1

    • SHA256

      eea3c5784f9715e2e5a161748c22dba09d3b995302287d46a3ce43ffd32e3316

    • SHA512

      abc10da0b5962f1c77d3cd4175eaacf5e1c9bc5ee1361ce5065ab04e058adafb69a634bd836dfb78a5dc0822f8c839595cd1638d7c05908d93f39e14925ba9e4

    • SSDEEP

      6144:y3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:y3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks