Overview

overview

10

Static

static

1b44a419ba...c8.exe

windows7-x64

10

1b44a419ba...c8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1b44a419ba9e440bc3ccd4c38e03db816cd74f74ef9ef4777ab3acee01e7c9c8

  • Size

    444KB

  • Sample

    221124-gkdtsafg6z

  • MD5

    da8a268585901b0de3c7bf326fed1755

  • SHA1

    8b60ca89d8c4b7cacae3ccb40542115883d4dc59

  • SHA256

    1b44a419ba9e440bc3ccd4c38e03db816cd74f74ef9ef4777ab3acee01e7c9c8

  • SHA512

    2db1f8987c81c70f80c5dcab86f2d4b3dbc5d89fa1c1e14320bb8e07537255d56876944289499c30171e27e1e85c5d4a3b73aebef032ef02fc83e454265e7549

  • SSDEEP

    12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjp:JoC7ijwFKlVadZ3+8qNp

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      1b44a419ba9e440bc3ccd4c38e03db816cd74f74ef9ef4777ab3acee01e7c9c8

    • Size

      444KB

    • MD5

      da8a268585901b0de3c7bf326fed1755

    • SHA1

      8b60ca89d8c4b7cacae3ccb40542115883d4dc59

    • SHA256

      1b44a419ba9e440bc3ccd4c38e03db816cd74f74ef9ef4777ab3acee01e7c9c8

    • SHA512

      2db1f8987c81c70f80c5dcab86f2d4b3dbc5d89fa1c1e14320bb8e07537255d56876944289499c30171e27e1e85c5d4a3b73aebef032ef02fc83e454265e7549

    • SSDEEP

      12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTjp:JoC7ijwFKlVadZ3+8qNp

    Score
    10/10
    evasionpersistencetrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks