Overview

overview

10

Static

static

0da4aed114...43.exe

windows7-x64

10

0da4aed114...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0da4aed1141179612a8cd3d24e493f9a6681470485cb3f71f1b6f2e8733e1d43

  • Size

    176KB

  • Sample

    221124-amwdaaeh33

  • MD5

    1b9d6ec7181f906613387bfa0351a2a0

  • SHA1

    4b4ae2f968bad4f794aa4257015cff662e326bb1

  • SHA256

    0da4aed1141179612a8cd3d24e493f9a6681470485cb3f71f1b6f2e8733e1d43

  • SHA512

    7bb00294368766802abeb179ad6e68f29696a6ea38c54ff5fa3dd8adc084af2c7352789e6ca174aba672297ffca91fa1e60db7707b21c961eec32df216a85e05

  • SSDEEP

    3072:OC1C8Wlh4GWtPuCaAYmG5bcFuKnvmb7/D26inavm4QLzHpXP6D8R8FOjcKvDHmB1:NI8WAGWtPuCaVmG5bnKnvmb7/D26caem

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      0da4aed1141179612a8cd3d24e493f9a6681470485cb3f71f1b6f2e8733e1d43

    • Size

      176KB

    • MD5

      1b9d6ec7181f906613387bfa0351a2a0

    • SHA1

      4b4ae2f968bad4f794aa4257015cff662e326bb1

    • SHA256

      0da4aed1141179612a8cd3d24e493f9a6681470485cb3f71f1b6f2e8733e1d43

    • SHA512

      7bb00294368766802abeb179ad6e68f29696a6ea38c54ff5fa3dd8adc084af2c7352789e6ca174aba672297ffca91fa1e60db7707b21c961eec32df216a85e05

    • SSDEEP

      3072:OC1C8Wlh4GWtPuCaAYmG5bcFuKnvmb7/D26inavm4QLzHpXP6D8R8FOjcKvDHmB1:NI8WAGWtPuCaVmG5bnKnvmb7/D26caem

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks