Overview

overview

8

Static

static

e710a43d93...e2.exe

windows7-x64

8

e710a43d93...e2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

  • Size

    159KB

  • Sample

    221125-yazryaae47

  • MD5

    cbe583b8f1e2623f3d84ca051ad9a285

  • SHA1

    623d7c79cb1f3cea1740f2e556f546c99f0705b9

  • SHA256

    e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

  • SHA512

    b29bace87f535f6ffbe8c44ddaed22d51b511dcc09b4fb2b34b799e1e74b1d51d57050c23e0ce3a98aef46deda59714e0111f39c32dc890adfe98be0e9fd9f88

  • SSDEEP

    3072:XK/kz6bycvuLIBs69/EeEDhpnM8nQ4aXRTM2WrVJzh/kPdeZbJIw87OAM:QiLIBvLCtJQvl7Gg+tIw87OAM

Score
8/10
persistence

Malware Config

Targets

    • Target

      e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

    • Size

      159KB

    • MD5

      cbe583b8f1e2623f3d84ca051ad9a285

    • SHA1

      623d7c79cb1f3cea1740f2e556f546c99f0705b9

    • SHA256

      e710a43d937a561ea012d4572d5e9f79eaa4da702646f78b29615acba8203be2

    • SHA512

      b29bace87f535f6ffbe8c44ddaed22d51b511dcc09b4fb2b34b799e1e74b1d51d57050c23e0ce3a98aef46deda59714e0111f39c32dc890adfe98be0e9fd9f88

    • SSDEEP

      3072:XK/kz6bycvuLIBs69/EeEDhpnM8nQ4aXRTM2WrVJzh/kPdeZbJIw87OAM:QiLIBvLCtJQvl7Gg+tIw87OAM

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks