9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36 | Triage

Submit
Reports

Overview

overview

Static

static

9129f04098...36.exe

windows7-x64

9129f04098...36.exe

windows10-2004-x64

8

Sharing

General

Target

9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36
Size

452KB
Sample

221124-gjy4bsfg5s
MD5

53a7a81db6cc635808d19beae3bdad9c
SHA1

9febeffe97c7cc0719dd9b5170b28b224887cbb2
SHA256

9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36
SHA512

2eb1fd1530b7cd4ceacbe1de78b37e068727f06af711e9a87b8c8e80973f7f43ce83a05888f51c8056f2d6125ab4525b133fdf681e1acb8ab495e74b16cadf89
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjyv:JoC7ijwFKlVadZ3+8qNA

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36.exe

Resource

win7-20220901-en

evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36.exe

Resource

win10v2004-20220901-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36
- Size
  
  452KB
- MD5
  
  53a7a81db6cc635808d19beae3bdad9c
- SHA1
  
  9febeffe97c7cc0719dd9b5170b28b224887cbb2
- SHA256
  
  9129f04098cd6e9502c0f8b45872ca4782e84ce3ff0dae65dd109881dbe38e36
- SHA512
  
  2eb1fd1530b7cd4ceacbe1de78b37e068727f06af711e9a87b8c8e80973f7f43ce83a05888f51c8056f2d6125ab4525b133fdf681e1acb8ab495e74b16cadf89
- SSDEEP
  
  12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjyv:JoC7ijwFKlVadZ3+8qNA
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy