Overview

overview

10

Static

static

bc391f3d31...4b.exe

windows7-x64

10

bc391f3d31...4b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bc391f3d31649d8f0698f5e9759ff0a003df8ff2bfa135dfef5646b0e566214b

  • Size

    32KB

  • Sample

    221127-qnbchaah47

  • MD5

    b4c076ad22ad25ecd22841c1caa6ff72

  • SHA1

    78aa047397b56ad3a8616a70abbe0089aa879a27

  • SHA256

    bc391f3d31649d8f0698f5e9759ff0a003df8ff2bfa135dfef5646b0e566214b

  • SHA512

    b17aab57a1473c6418682b1b308fb45e0b682bf9602af32103ea96417f6bf25315463a713f01665e73a818d323372f7b5a548ac499bb7d89aa86b312da41393f

  • SSDEEP

    768:zgpcJkoH/cYLeV/omwUZJt6R7pA21KUsFZh4naaj:ufoH0lpweJt6R7pA21KRThQzj

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      bc391f3d31649d8f0698f5e9759ff0a003df8ff2bfa135dfef5646b0e566214b

    • Size

      32KB

    • MD5

      b4c076ad22ad25ecd22841c1caa6ff72

    • SHA1

      78aa047397b56ad3a8616a70abbe0089aa879a27

    • SHA256

      bc391f3d31649d8f0698f5e9759ff0a003df8ff2bfa135dfef5646b0e566214b

    • SHA512

      b17aab57a1473c6418682b1b308fb45e0b682bf9602af32103ea96417f6bf25315463a713f01665e73a818d323372f7b5a548ac499bb7d89aa86b312da41393f

    • SSDEEP

      768:zgpcJkoH/cYLeV/omwUZJt6R7pA21KUsFZh4naaj:ufoH0lpweJt6R7pA21KRThQzj

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks