Overview

overview

10

Static

static

bf0c00dfa8...e9.exe

windows7-x64

10

bf0c00dfa8...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf0c00dfa8272340f3516e78516d8c6e9ea796777031e884c746e602b80b04e9

  • Size

    176KB

  • Sample

    221124-al32qseg67

  • MD5

    26f91937d7f3eb1376fe721af82a9fe0

  • SHA1

    848bd0fa61ab6340b804b42c233c76de4d7441d9

  • SHA256

    bf0c00dfa8272340f3516e78516d8c6e9ea796777031e884c746e602b80b04e9

  • SHA512

    ddb18a392547c3b4ededbf3e263f8b9a2782845a577bbf9fe10d9744807cb296d2bd126b03f86e1e7739d34de32427774e4411cf430ac15902650f6459c10a7b

  • SSDEEP

    3072:df04IcfpHlp1D2KcwjIU2aTObcpT/pHkEAbN/yK/fObT/bGiCV/COqoSQ1iBuAZI:904PfpHlp1KKcwjIDaTObcZ/pHkMK/fn

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      bf0c00dfa8272340f3516e78516d8c6e9ea796777031e884c746e602b80b04e9

    • Size

      176KB

    • MD5

      26f91937d7f3eb1376fe721af82a9fe0

    • SHA1

      848bd0fa61ab6340b804b42c233c76de4d7441d9

    • SHA256

      bf0c00dfa8272340f3516e78516d8c6e9ea796777031e884c746e602b80b04e9

    • SHA512

      ddb18a392547c3b4ededbf3e263f8b9a2782845a577bbf9fe10d9744807cb296d2bd126b03f86e1e7739d34de32427774e4411cf430ac15902650f6459c10a7b

    • SSDEEP

      3072:df04IcfpHlp1D2KcwjIU2aTObcpT/pHkEAbN/yK/fObT/bGiCV/COqoSQ1iBuAZI:904PfpHlp1KKcwjIDaTObcZ/pHkMK/fn

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks