Overview

overview

10

Static

static

abe29190d3...79.exe

windows7-x64

10

abe29190d3...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679

  • Size

    2.6MB

  • Sample

    221124-e118xacb81

  • MD5

    ae8bbde35ae59e3f26f0deb76d3b6918

  • SHA1

    54dd77953b08d22ba8427df84318a8441e3bc8b2

  • SHA256

    abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679

  • SHA512

    1b05a9b126f816e2d7fcd003f9a310296a574b54cb14c34d0f800ad2321fb04561a896926ea3a62308a29647bd3b5df06c631379ac0ea266c9a614e4d35fc7d4

  • SSDEEP

    49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yb:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDp

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679

    • Size

      2.6MB

    • MD5

      ae8bbde35ae59e3f26f0deb76d3b6918

    • SHA1

      54dd77953b08d22ba8427df84318a8441e3bc8b2

    • SHA256

      abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679

    • SHA512

      1b05a9b126f816e2d7fcd003f9a310296a574b54cb14c34d0f800ad2321fb04561a896926ea3a62308a29647bd3b5df06c631379ac0ea266c9a614e4d35fc7d4

    • SSDEEP

      49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yb:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDp

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks