Overview

overview

8

Static

static

4655c14487...23.exe

windows7-x64

8

4655c14487...23.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23

  • Size

    3.3MB

  • Sample

    221124-rx8vssag78

  • MD5

    c2f748e96d2db66b84c87e6a3465ceca

  • SHA1

    fb87dd59f4b7498550af16fd3b21f44b9f6ac523

  • SHA256

    4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23

  • SHA512

    3c51d52e94a06c31224a0ae52bb383f3a01dcec3693f8fcd6e4ced46bc44e485797ed3201f8880e8a8703fb7f6d62dd974e738fc6a1c64fab1e6b1688cf0de41

  • SSDEEP

    98304:OLeyl6lN3RiDXbkpLHj6u+qHqWRWJU7yii:OjEfsDgpbjCvJUu3

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23

    • Size

      3.3MB

    • MD5

      c2f748e96d2db66b84c87e6a3465ceca

    • SHA1

      fb87dd59f4b7498550af16fd3b21f44b9f6ac523

    • SHA256

      4655c1448795668c21904ce39b61dbf2aa278df7d0ade347352bf6405ca83b23

    • SHA512

      3c51d52e94a06c31224a0ae52bb383f3a01dcec3693f8fcd6e4ced46bc44e485797ed3201f8880e8a8703fb7f6d62dd974e738fc6a1c64fab1e6b1688cf0de41

    • SSDEEP

      98304:OLeyl6lN3RiDXbkpLHj6u+qHqWRWJU7yii:OjEfsDgpbjCvJUu3

    Score
    8/10
    discoverypersistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks