Overview

overview

10

Static

static

6eaf8f2766...8b.exe

windows7-x64

10

6eaf8f2766...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b

  • Size

    248KB

  • Sample

    221124-aqmwbaac4w

  • MD5

    34bf25da402351ff5a346fed32ba6280

  • SHA1

    f208adc9f7c253db5edf6cf8263cbf57655bb7e2

  • SHA256

    6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b

  • SHA512

    0858b8075f5aa14a5c01fa1197987d43c13418fb309b3fa8bdb33048b4da3a8e16e677743939c566c5a73ec8fe7b3337173324d9b1a65493b6c8a36dcba497ac

  • SSDEEP

    3072:gr1Pci6xjLw6fF44m1shLv0diVjtt3PQ0pU3623sWMGCX799A2Uuu6WSLOXnt7sp:grRAw6+4m1umwptvpIMGaQ66jtc

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b

    • Size

      248KB

    • MD5

      34bf25da402351ff5a346fed32ba6280

    • SHA1

      f208adc9f7c253db5edf6cf8263cbf57655bb7e2

    • SHA256

      6eaf8f27666e511d620066188ca34760ac44d3241e90554bc5cc696cdea0d88b

    • SHA512

      0858b8075f5aa14a5c01fa1197987d43c13418fb309b3fa8bdb33048b4da3a8e16e677743939c566c5a73ec8fe7b3337173324d9b1a65493b6c8a36dcba497ac

    • SSDEEP

      3072:gr1Pci6xjLw6fF44m1shLv0diVjtt3PQ0pU3623sWMGCX799A2Uuu6WSLOXnt7sp:grRAw6+4m1umwptvpIMGaQ66jtc

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks