Overview

overview

8

Static

static

dc81b0d2c5...9b.exe

windows7-x64

8

dc81b0d2c5...9b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b

  • Size

    467KB

  • Sample

    221124-f73kzsfa3v

  • MD5

    773251535e248889e0f7536294b9e7ec

  • SHA1

    e8aee374c842f0a21d8ffe20dac6d321f2c612df

  • SHA256

    dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b

  • SHA512

    000013a61bde51eb3dc18da46d3cdf7b5f4910d02e07054b43bb5fe160e8aac69583fa53abc2387afb453136078ad9f79db201b674a43eb548ccaffb7c9c7e76

  • SSDEEP

    12288:4bVtorSa42uKNEPnJHmCUVfgHIwNPxfN6atcz+3w6:Ior/uQEPJHjUhgoyfYt+3w6

Score
8/10
persistence

Malware Config

Targets

    • Target

      dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b

    • Size

      467KB

    • MD5

      773251535e248889e0f7536294b9e7ec

    • SHA1

      e8aee374c842f0a21d8ffe20dac6d321f2c612df

    • SHA256

      dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b

    • SHA512

      000013a61bde51eb3dc18da46d3cdf7b5f4910d02e07054b43bb5fe160e8aac69583fa53abc2387afb453136078ad9f79db201b674a43eb548ccaffb7c9c7e76

    • SSDEEP

      12288:4bVtorSa42uKNEPnJHmCUVfgHIwNPxfN6atcz+3w6:Ior/uQEPJHjUhgoyfYt+3w6

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks