Overview

overview

8

Static

static

20e2dadbca...14.exe

windows7-x64

8

20e2dadbca...14.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    20e2dadbca4ca9f09637251c62c0e8bf68e99f90a3697c0a167fdd42853b9f14

  • Size

    741KB

  • Sample

    221125-zrq2sshd9s

  • MD5

    a328729ffd121a6cc86a83f6ac89da56

  • SHA1

    217042e9aefa78366bc5a5b4d2d6fb2f7ea845a3

  • SHA256

    20e2dadbca4ca9f09637251c62c0e8bf68e99f90a3697c0a167fdd42853b9f14

  • SHA512

    b952a59384bb5d5fd6ee6d42ce4a3eada9ad215ff7ed4fc60eaa9fb6bf4d576ba81a7f298bb837e15170cba7426e65ee1ee68d48fad4fedefad7ecdd38f07351

  • SSDEEP

    12288:K+M2mpMPpMLjVgHORtYdrcV47nD9o2SHnARZuXTYgFZF3WgXMdokreQl7jalwAH:XM7wYJ8ziQD94HgcDtrGgXMFtlq

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      20e2dadbca4ca9f09637251c62c0e8bf68e99f90a3697c0a167fdd42853b9f14

    • Size

      741KB

    • MD5

      a328729ffd121a6cc86a83f6ac89da56

    • SHA1

      217042e9aefa78366bc5a5b4d2d6fb2f7ea845a3

    • SHA256

      20e2dadbca4ca9f09637251c62c0e8bf68e99f90a3697c0a167fdd42853b9f14

    • SHA512

      b952a59384bb5d5fd6ee6d42ce4a3eada9ad215ff7ed4fc60eaa9fb6bf4d576ba81a7f298bb837e15170cba7426e65ee1ee68d48fad4fedefad7ecdd38f07351

    • SSDEEP

      12288:K+M2mpMPpMLjVgHORtYdrcV47nD9o2SHnARZuXTYgFZF3WgXMdokreQl7jalwAH:XM7wYJ8ziQD94HgcDtrGgXMFtlq

    Score
    8/10
    discoverypersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks