Overview

overview

10

Static

static

bed673c836...a8.exe

windows7-x64

10

bed673c836...a8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bed673c83689f8eca1f102768eff56a93ce3a35255ea2e9b58c85329c100afa8

  • Size

    204KB

  • Sample

    221202-hch9zabh78

  • MD5

    a211c9430bbea25da9ae8676275bb404

  • SHA1

    3cb45685b03a3ef951b8fd3fa4b6307976b1b66f

  • SHA256

    bed673c83689f8eca1f102768eff56a93ce3a35255ea2e9b58c85329c100afa8

  • SHA512

    068c83d4aec189915b71c1a5e924d6ab85432f70a02bbe59d9e9121af491db8c29d8fb205980d3b6f6f6d9f5107b64e3c723c98af605aa6879c06a822e79f671

  • SSDEEP

    3072:hmFW8RA00tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWVHu:4U4A04QxL7B9W0c1RCzR/fSmluO

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      bed673c83689f8eca1f102768eff56a93ce3a35255ea2e9b58c85329c100afa8

    • Size

      204KB

    • MD5

      a211c9430bbea25da9ae8676275bb404

    • SHA1

      3cb45685b03a3ef951b8fd3fa4b6307976b1b66f

    • SHA256

      bed673c83689f8eca1f102768eff56a93ce3a35255ea2e9b58c85329c100afa8

    • SHA512

      068c83d4aec189915b71c1a5e924d6ab85432f70a02bbe59d9e9121af491db8c29d8fb205980d3b6f6f6d9f5107b64e3c723c98af605aa6879c06a822e79f671

    • SSDEEP

      3072:hmFW8RA00tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWVHu:4U4A04QxL7B9W0c1RCzR/fSmluO

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks