Overview

overview

10

Static

static

5352365d56...fe.exe

windows7-x64

10

5352365d56...fe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5352365d564950a3889746b795d5ae0d67e5d1ec2b8e1be68c1a47124fd9b5fe

  • Size

    504KB

  • Sample

    221203-2awxtsaf99

  • MD5

    0470d85816b561d645e1bbacde4b8836

  • SHA1

    93410b37cf75b5d5916d794136bb0591a3384c67

  • SHA256

    5352365d564950a3889746b795d5ae0d67e5d1ec2b8e1be68c1a47124fd9b5fe

  • SHA512

    3e790c577829d606110ebbf3ecaac6b649723693dca0e1b09b0b22f12b9b466b3a4cdbe93f2da84e35bd6527baec172c0598013d61caa2e915fdf303981377c9

  • SSDEEP

    6144:Uj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionKysy:e6onxOp8FySpE5zvIdtU+YmefnB

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      5352365d564950a3889746b795d5ae0d67e5d1ec2b8e1be68c1a47124fd9b5fe

    • Size

      504KB

    • MD5

      0470d85816b561d645e1bbacde4b8836

    • SHA1

      93410b37cf75b5d5916d794136bb0591a3384c67

    • SHA256

      5352365d564950a3889746b795d5ae0d67e5d1ec2b8e1be68c1a47124fd9b5fe

    • SHA512

      3e790c577829d606110ebbf3ecaac6b649723693dca0e1b09b0b22f12b9b466b3a4cdbe93f2da84e35bd6527baec172c0598013d61caa2e915fdf303981377c9

    • SSDEEP

      6144:Uj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionKysy:e6onxOp8FySpE5zvIdtU+YmefnB

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks