Overview

overview

10

Static

static

e78b73e8cc...4f.exe

windows7-x64

10

e78b73e8cc...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e78b73e8cc52a754938328bc1975e0d4e7896577ba9a0f8ac8d50de9a3db7b4f

  • Size

    1.3MB

  • Sample

    221202-1zkqescf6v

  • MD5

    f60f1039d3d2edb2aac7114ad53c973b

  • SHA1

    0f1a1f068b50726f1b31d32f2a848d89eff6fd57

  • SHA256

    e78b73e8cc52a754938328bc1975e0d4e7896577ba9a0f8ac8d50de9a3db7b4f

  • SHA512

    03e321a7fbdea343f95ed47533fd30ad2955b714b8a6d494c00c556d5e178ef11e7e1052b0660fc7f75af523496121dc79006d792e1028c9065aae302bfa8428

  • SSDEEP

    24576:gZusv/DwNLHPJH6pYCkeKW/8XwQmRtPF+mviWavPzGLgO2uptmh:vsv/GvtkHKW/8XwQUhahyLgwpt+

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      e78b73e8cc52a754938328bc1975e0d4e7896577ba9a0f8ac8d50de9a3db7b4f

    • Size

      1.3MB

    • MD5

      f60f1039d3d2edb2aac7114ad53c973b

    • SHA1

      0f1a1f068b50726f1b31d32f2a848d89eff6fd57

    • SHA256

      e78b73e8cc52a754938328bc1975e0d4e7896577ba9a0f8ac8d50de9a3db7b4f

    • SHA512

      03e321a7fbdea343f95ed47533fd30ad2955b714b8a6d494c00c556d5e178ef11e7e1052b0660fc7f75af523496121dc79006d792e1028c9065aae302bfa8428

    • SSDEEP

      24576:gZusv/DwNLHPJH6pYCkeKW/8XwQmRtPF+mviWavPzGLgO2uptmh:vsv/GvtkHKW/8XwQUhahyLgwpt+

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks