Overview

overview

10

Static

static

d2a280ae80...72.exe

windows7-x64

10

d2a280ae80...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2a280ae80d6081a356e9b811ba13ab59cd3f19cf971b560bfc9f245e95fe072

  • Size

    220KB

  • Sample

    221129-vhj5nsbd7s

  • MD5

    aad1c6464829acdb136f804c69cd8caa

  • SHA1

    d68ec9d860f3b965379588850ee3298dd9431947

  • SHA256

    d2a280ae80d6081a356e9b811ba13ab59cd3f19cf971b560bfc9f245e95fe072

  • SHA512

    d9a2096f10648fc04ae179b1b9532fcf3a58f6a59426376fd7e9d09306a3c5761aa433d91ab19fbd9b6f35ecfe3435c0a76711a6f9a26d76f85151f4404225de

  • SSDEEP

    3072:NfEFCI/HNDyfyT/v+r5nP3W9KVpTtJNFOgHGrOkGuOuY:NWeyTX+rc9KztHlGrOFuE

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      d2a280ae80d6081a356e9b811ba13ab59cd3f19cf971b560bfc9f245e95fe072

    • Size

      220KB

    • MD5

      aad1c6464829acdb136f804c69cd8caa

    • SHA1

      d68ec9d860f3b965379588850ee3298dd9431947

    • SHA256

      d2a280ae80d6081a356e9b811ba13ab59cd3f19cf971b560bfc9f245e95fe072

    • SHA512

      d9a2096f10648fc04ae179b1b9532fcf3a58f6a59426376fd7e9d09306a3c5761aa433d91ab19fbd9b6f35ecfe3435c0a76711a6f9a26d76f85151f4404225de

    • SSDEEP

      3072:NfEFCI/HNDyfyT/v+r5nP3W9KVpTtJNFOgHGrOkGuOuY:NWeyTX+rc9KztHlGrOFuE

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks