Overview

overview

10

Static

static

6f10e6ae57...2f.exe

windows7-x64

10

6f10e6ae57...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f

  • Size

    704KB

  • Sample

    221202-x895wsbc8t

  • MD5

    26b67fe18705397aa22363c12e22ae54

  • SHA1

    6648caac399f7e9a24fa6692430beca1ad581e79

  • SHA256

    6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f

  • SHA512

    bca1b2ba6835c2c0a600abc3d35bc4351c301813f1fc7edd7201cc47ec4bfcc86ee690c46c22bb153f68b9654be06840435c146f72570e3e0f110c6155741bb4

  • SSDEEP

    6144:5cFvrd1rWkNYiclkBw1x42dy8r1YAbycKvN/+86JQPDHDdx/QtqV:u1dCicWy1xFc8r1NbZKvgPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f

    • Size

      704KB

    • MD5

      26b67fe18705397aa22363c12e22ae54

    • SHA1

      6648caac399f7e9a24fa6692430beca1ad581e79

    • SHA256

      6f10e6ae5761f0b79a052c7fe0a6ede73eea777595c7915d80f7641c8929af2f

    • SHA512

      bca1b2ba6835c2c0a600abc3d35bc4351c301813f1fc7edd7201cc47ec4bfcc86ee690c46c22bb153f68b9654be06840435c146f72570e3e0f110c6155741bb4

    • SSDEEP

      6144:5cFvrd1rWkNYiclkBw1x42dy8r1YAbycKvN/+86JQPDHDdx/QtqV:u1dCicWy1xFc8r1NbZKvgPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks