Overview

overview

8

Static

static

dbf4eed2ff...82.exe

windows7-x64

8

dbf4eed2ff...82.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbf4eed2ff148d9ddb7c7d4bd4d08943b88a992a876f14a1f5688d2b65450282

  • Size

    235KB

  • Sample

    221128-sfz21acc26

  • MD5

    a017b4b86dc239fe0cefc07a726505f7

  • SHA1

    4f80660d04f9b18953aaa008f63a65ac2fecd913

  • SHA256

    dbf4eed2ff148d9ddb7c7d4bd4d08943b88a992a876f14a1f5688d2b65450282

  • SHA512

    36058a74780fab6d246b400f58702bf0bd51d3823a1423dad363c6467a8a7753f68471ef971c2d51cfb670e9041da058121a50fbea4c731aeca4bf2c9182515f

  • SSDEEP

    6144:CeV9TbKC3OgmJPq8jMwfMxBhPmPNKedp+T:CebTbvegkqyJEXhWNz+

Score
8/10
persistence

Malware Config

Targets

    • Target

      dbf4eed2ff148d9ddb7c7d4bd4d08943b88a992a876f14a1f5688d2b65450282

    • Size

      235KB

    • MD5

      a017b4b86dc239fe0cefc07a726505f7

    • SHA1

      4f80660d04f9b18953aaa008f63a65ac2fecd913

    • SHA256

      dbf4eed2ff148d9ddb7c7d4bd4d08943b88a992a876f14a1f5688d2b65450282

    • SHA512

      36058a74780fab6d246b400f58702bf0bd51d3823a1423dad363c6467a8a7753f68471ef971c2d51cfb670e9041da058121a50fbea4c731aeca4bf2c9182515f

    • SSDEEP

      6144:CeV9TbKC3OgmJPq8jMwfMxBhPmPNKedp+T:CebTbvegkqyJEXhWNz+

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Security Software Discovery

1
T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks