Overview

overview

10

Static

static

dedc4a9298...c3.exe

windows7-x64

10

dedc4a9298...c3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dedc4a929867fa70e79edf9548fe5cc57e9276c7d9bddaad3125b51c1573dec3

  • Size

    716KB

  • Sample

    221202-3atm5sdg24

  • MD5

    b59f0e6d5ffdbb93f19933592faa18a1

  • SHA1

    624aa5b8091e879fb2b377dc1a2d1ecee239d649

  • SHA256

    dedc4a929867fa70e79edf9548fe5cc57e9276c7d9bddaad3125b51c1573dec3

  • SHA512

    2e9f13087ca87f7f5c979e38d5c91f2f54b786bd8f360d3dbad729d820ac8cf71085855758c60be0d511683ef6ae3e3e765aa0c123061c0cdf4cca4593b4a3da

  • SSDEEP

    12288:g72bntEDs72bntEDo72bntEDs72bntEDLDREQG:g72zms72zmo72zms72zmL9E1

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      dedc4a929867fa70e79edf9548fe5cc57e9276c7d9bddaad3125b51c1573dec3

    • Size

      716KB

    • MD5

      b59f0e6d5ffdbb93f19933592faa18a1

    • SHA1

      624aa5b8091e879fb2b377dc1a2d1ecee239d649

    • SHA256

      dedc4a929867fa70e79edf9548fe5cc57e9276c7d9bddaad3125b51c1573dec3

    • SHA512

      2e9f13087ca87f7f5c979e38d5c91f2f54b786bd8f360d3dbad729d820ac8cf71085855758c60be0d511683ef6ae3e3e765aa0c123061c0cdf4cca4593b4a3da

    • SSDEEP

      12288:g72bntEDs72bntEDo72bntEDs72bntEDLDREQG:g72zms72zmo72zms72zmL9E1

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks