Overview

overview

8

Static

static

505117ecfc...a4.exe

windows7-x64

8

505117ecfc...a4.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    505117ecfca554e3c2a405320c8de5ed8ccfc744b1d6286f62576df658e70da4

  • Size

    623KB

  • Sample

    221127-tjd5daea6t

  • MD5

    cb4de18e8eed8b72067444315245a28f

  • SHA1

    e3536a04940c911ccec48891fa92c382e38c2a67

  • SHA256

    505117ecfca554e3c2a405320c8de5ed8ccfc744b1d6286f62576df658e70da4

  • SHA512

    16f92a2753433ce9532b4918664ac7e72865f883b24da4ace058ef3b87889e8586c54c6d39aed6a61e1e386ad63952e3add6656bf62b372e80722f9c26952e68

  • SSDEEP

    12288:ReexRZpBF9RpPd+bAE09J4nXlv2hlO7LZzV:EbAE09y2o

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      505117ecfca554e3c2a405320c8de5ed8ccfc744b1d6286f62576df658e70da4

    • Size

      623KB

    • MD5

      cb4de18e8eed8b72067444315245a28f

    • SHA1

      e3536a04940c911ccec48891fa92c382e38c2a67

    • SHA256

      505117ecfca554e3c2a405320c8de5ed8ccfc744b1d6286f62576df658e70da4

    • SHA512

      16f92a2753433ce9532b4918664ac7e72865f883b24da4ace058ef3b87889e8586c54c6d39aed6a61e1e386ad63952e3add6656bf62b372e80722f9c26952e68

    • SSDEEP

      12288:ReexRZpBF9RpPd+bAE09J4nXlv2hlO7LZzV:EbAE09y2o

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks