c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b | Triage

Submit
Reports

Overview

overview

Static

static

c58e8a0d54...5b.exe

windows7-x64

c58e8a0d54...5b.exe

windows10-2004-x64

8

Sharing

General

Target

c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b
Size

451KB
Sample

221124-gjmejafg3w
MD5

7d71041e47ea59cca6eb004ff189c4ba
SHA1

ec96e49e238bcd2f3aaf00c950fa7cdc70670750
SHA256

c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b
SHA512

5d869bacc87157bf132bbf247ba7af6990aa23d964c8e645702b427d268f35171907a5e280a3e2c9d0b0115d04a92ed6efcc64f967aae372ce7e46fe65a645fd
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjdJ:JoC7ijwFKlVadZ3+8qNdJ

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b.exe

Resource

win7-20220812-en

evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b
- Size
  
  451KB
- MD5
  
  7d71041e47ea59cca6eb004ff189c4ba
- SHA1
  
  ec96e49e238bcd2f3aaf00c950fa7cdc70670750
- SHA256
  
  c58e8a0d54cc3e19efe4bffecf610c721b853ce97a4e575219744dd05491d35b
- SHA512
  
  5d869bacc87157bf132bbf247ba7af6990aa23d964c8e645702b427d268f35171907a5e280a3e2c9d0b0115d04a92ed6efcc64f967aae372ce7e46fe65a645fd
- SSDEEP
  
  12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjdJ:JoC7ijwFKlVadZ3+8qNdJ
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy