Overview

overview

10

Static

static

48828e2fa1...a0.exe

windows7-x64

10

48828e2fa1...a0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    48828e2fa1208f57355b131f9ddefcf14b5a14b6dd9ecae877735a1f11f678a0

  • Size

    159KB

  • Sample

    221202-vv3gsacc51

  • MD5

    058b5e9139506d7d40bac665ee09d160

  • SHA1

    1d6cb905b09116384d6042bf70ac586e2ba5be82

  • SHA256

    48828e2fa1208f57355b131f9ddefcf14b5a14b6dd9ecae877735a1f11f678a0

  • SHA512

    da851764a11801d9f47b4c0ee9c5311ad890eed0d4e4b6c06b46d17524758a6931ec0b8bab58cfeb60b82c6430bd1819fcb04e9ff3184197ca7585c25162dd97

  • SSDEEP

    3072:T9iVWl1nur1iNikaVoEfaq0VNwnv4dmvor6EBA:QVmur1TPft2q4dWEO

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      48828e2fa1208f57355b131f9ddefcf14b5a14b6dd9ecae877735a1f11f678a0

    • Size

      159KB

    • MD5

      058b5e9139506d7d40bac665ee09d160

    • SHA1

      1d6cb905b09116384d6042bf70ac586e2ba5be82

    • SHA256

      48828e2fa1208f57355b131f9ddefcf14b5a14b6dd9ecae877735a1f11f678a0

    • SHA512

      da851764a11801d9f47b4c0ee9c5311ad890eed0d4e4b6c06b46d17524758a6931ec0b8bab58cfeb60b82c6430bd1819fcb04e9ff3184197ca7585c25162dd97

    • SSDEEP

      3072:T9iVWl1nur1iNikaVoEfaq0VNwnv4dmvor6EBA:QVmur1TPft2q4dWEO

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks