Overview

overview

8

Static

static

6489e1f7e5...a5.exe

windows7-x64

8

6489e1f7e5...a5.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6489e1f7e50e644f0ebb8b9f6b1ca6e23bfa106d03ca5dcc319d1b18fb5970a5

  • Size

    223KB

  • Sample

    221125-rxxgrshc8s

  • MD5

    325ef393cb894ec32c3e0496adb954f4

  • SHA1

    3942bc68d6a5f292f396c79fef1aaf46a2413b45

  • SHA256

    6489e1f7e50e644f0ebb8b9f6b1ca6e23bfa106d03ca5dcc319d1b18fb5970a5

  • SHA512

    f6f265673db1a31ef58bcec87d51b1ad7788e474ecd35fa8b95b7a3888a44911636ddaefe4461b5a6c916819f2300726367e6de4c2ddea55e33be69da1eab226

  • SSDEEP

    3072:HbHZEXb+0peSIfzxvOkO+7uE8/SkPPADH4cl5KwoY1uFFpzZL1lY4/D3jsl1vjL6:7HZL/SIf7qJ/uHNW5K2DTslxjm

Score
8/10
persistence

Malware Config

Targets

    • Target

      6489e1f7e50e644f0ebb8b9f6b1ca6e23bfa106d03ca5dcc319d1b18fb5970a5

    • Size

      223KB

    • MD5

      325ef393cb894ec32c3e0496adb954f4

    • SHA1

      3942bc68d6a5f292f396c79fef1aaf46a2413b45

    • SHA256

      6489e1f7e50e644f0ebb8b9f6b1ca6e23bfa106d03ca5dcc319d1b18fb5970a5

    • SHA512

      f6f265673db1a31ef58bcec87d51b1ad7788e474ecd35fa8b95b7a3888a44911636ddaefe4461b5a6c916819f2300726367e6de4c2ddea55e33be69da1eab226

    • SSDEEP

      3072:HbHZEXb+0peSIfzxvOkO+7uE8/SkPPADH4cl5KwoY1uFFpzZL1lY4/D3jsl1vjL6:7HZL/SIf7qJ/uHNW5K2DTslxjm

    Score
    8/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks