Overview

overview

10

Static

static

b75dfc19ed...d5.exe

windows7-x64

10

b75dfc19ed...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b75dfc19ed22ed3fe3b678994052772c383b0ffc815cacb0d90c6e8af91857d5

  • Size

    415KB

  • Sample

    221124-ekmetafg92

  • MD5

    b9a55edd67fa09b1369d6519f777d610

  • SHA1

    8a8aaf3d4dbbaeea2d7f2b00faca336db2229720

  • SHA256

    b75dfc19ed22ed3fe3b678994052772c383b0ffc815cacb0d90c6e8af91857d5

  • SHA512

    055bc0a31916a4b32e55f46b3a79bbb3bb454611a76fef728b6f05195a8cbf151302db56fb50c3920f8d6b89dd8cdb09a1871a5127d31190dc70efabda8d8eb5

  • SSDEEP

    6144:rpAuwJHG3Vs2/jCYvrM3b9sywDKCzaEf7Bd:uue022/jF/DGED

Score
10/10
persistence

Malware Config

Targets

    • Target

      b75dfc19ed22ed3fe3b678994052772c383b0ffc815cacb0d90c6e8af91857d5

    • Size

      415KB

    • MD5

      b9a55edd67fa09b1369d6519f777d610

    • SHA1

      8a8aaf3d4dbbaeea2d7f2b00faca336db2229720

    • SHA256

      b75dfc19ed22ed3fe3b678994052772c383b0ffc815cacb0d90c6e8af91857d5

    • SHA512

      055bc0a31916a4b32e55f46b3a79bbb3bb454611a76fef728b6f05195a8cbf151302db56fb50c3920f8d6b89dd8cdb09a1871a5127d31190dc70efabda8d8eb5

    • SSDEEP

      6144:rpAuwJHG3Vs2/jCYvrM3b9sywDKCzaEf7Bd:uue022/jF/DGED

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks