General

  • Target

    43957594ef8ae331dad685cf5fdfdb1fcdfe4b040ddf776cd2bf53ce8df11987

  • Size

    305KB

  • Sample

    221128-wg5knadg28

  • MD5

    1a1733bae2a5c22dc130d2f0f82302ef

  • SHA1

    5334d5f2c4d14c214ce4e86fe3f5098b7f38d008

  • SHA256

    43957594ef8ae331dad685cf5fdfdb1fcdfe4b040ddf776cd2bf53ce8df11987

  • SHA512

    0b9b54cc679e2c89cb296e598695df66367281793899002751ca40e56c12cdced91f10d031e8051bb70f91b4449a65d1dfd21b7884e1cfb57e1fe31092eb2e30

  • SSDEEP

    6144:XNFawti8qjlBtYCcYWctAnvLxSRO3NO4n06qAOssKfpYT:doQiDpBuCcB9WO3U40hAOssMps

Score
10/10

Malware Config

Targets

    • Target

      43957594ef8ae331dad685cf5fdfdb1fcdfe4b040ddf776cd2bf53ce8df11987

    • Size

      305KB

    • MD5

      1a1733bae2a5c22dc130d2f0f82302ef

    • SHA1

      5334d5f2c4d14c214ce4e86fe3f5098b7f38d008

    • SHA256

      43957594ef8ae331dad685cf5fdfdb1fcdfe4b040ddf776cd2bf53ce8df11987

    • SHA512

      0b9b54cc679e2c89cb296e598695df66367281793899002751ca40e56c12cdced91f10d031e8051bb70f91b4449a65d1dfd21b7884e1cfb57e1fe31092eb2e30

    • SSDEEP

      6144:XNFawti8qjlBtYCcYWctAnvLxSRO3NO4n06qAOssKfpYT:doQiDpBuCcB9WO3U40hAOssMps

    Score
    10/10
    • Modifies WinLogon for persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Security Software Discovery

1
T1063

Tasks