Overview

overview

8

Static

static

c2ae5dc118...c7.exe

windows7-x64

8

c2ae5dc118...c7.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2ae5dc11814839d901652c46728e30ba8a782cce40dce60b3e1d51dae57bbc7

  • Size

    3.4MB

  • Sample

    221125-2llk8sfb5w

  • MD5

    885ac7429b7ee9e6b640d8bcbafa7e36

  • SHA1

    0ac6da5372ecf926b88f2d8b01f1727c11b4a90f

  • SHA256

    c2ae5dc11814839d901652c46728e30ba8a782cce40dce60b3e1d51dae57bbc7

  • SHA512

    8c065ed5a69a6c595dbdec8299b61ff322dc55d0c1a370ca1957c5e0737bfff4e5189b199e7969dad45c40998b170c287297369a8d067907b46234d61daea6a9

  • SSDEEP

    98304:23yobVyq03fv0oKATM6A/7zf8iEFb1OL6PVgNZzf:Myey13EoXM68vHO5fPeNZz

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      c2ae5dc11814839d901652c46728e30ba8a782cce40dce60b3e1d51dae57bbc7

    • Size

      3.4MB

    • MD5

      885ac7429b7ee9e6b640d8bcbafa7e36

    • SHA1

      0ac6da5372ecf926b88f2d8b01f1727c11b4a90f

    • SHA256

      c2ae5dc11814839d901652c46728e30ba8a782cce40dce60b3e1d51dae57bbc7

    • SHA512

      8c065ed5a69a6c595dbdec8299b61ff322dc55d0c1a370ca1957c5e0737bfff4e5189b199e7969dad45c40998b170c287297369a8d067907b46234d61daea6a9

    • SSDEEP

      98304:23yobVyq03fv0oKATM6A/7zf8iEFb1OL6PVgNZzf:Myey13EoXM68vHO5fPeNZz

    Score
    8/10
    discoverypersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks