Overview

overview

8

Static

static

dd59f8e7fc...ea.exe

windows7-x64

8

dd59f8e7fc...ea.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd59f8e7fcc27c8b2e4fab1963d5b00c6a7365109e016968e3781efd621023ea

  • Size

    61KB

  • Sample

    221125-qv5jxsee91

  • MD5

    e027153d983946c3a5e336ba6639f178

  • SHA1

    8648bb28d6a0d377ebdf4d91231cb54815001933

  • SHA256

    dd59f8e7fcc27c8b2e4fab1963d5b00c6a7365109e016968e3781efd621023ea

  • SHA512

    fbbdc0e909037dc169e9be30e5a446b565bbd74b18e07c39ac13c5de7106985dc04c75eb186a732db0f2b3ebb12341a313c509230744bcc7804e71b3cf067554

  • SSDEEP

    1536:pM3K0rz6fS/tdvyO2eLehvGb/r/CAp2/DSjh/Zku:i60rWfofvH3ehv6/Ce6SjfH

Score
8/10
persistence

Malware Config

Targets

    • Target

      dd59f8e7fcc27c8b2e4fab1963d5b00c6a7365109e016968e3781efd621023ea

    • Size

      61KB

    • MD5

      e027153d983946c3a5e336ba6639f178

    • SHA1

      8648bb28d6a0d377ebdf4d91231cb54815001933

    • SHA256

      dd59f8e7fcc27c8b2e4fab1963d5b00c6a7365109e016968e3781efd621023ea

    • SHA512

      fbbdc0e909037dc169e9be30e5a446b565bbd74b18e07c39ac13c5de7106985dc04c75eb186a732db0f2b3ebb12341a313c509230744bcc7804e71b3cf067554

    • SSDEEP

      1536:pM3K0rz6fS/tdvyO2eLehvGb/r/CAp2/DSjh/Zku:i60rWfofvH3ehv6/Ce6SjfH

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks