Overview

overview

8

Static

static

1

e77948b5a2...6f.exe

windows7-x64

8

e77948b5a2...6f.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e77948b5a238251a8765acbc392671014fe7298dd177db8262a10c4f4deb5f6f

  • Size

    102KB

  • Sample

    221203-aj929sbh9y

  • MD5

    1d9e7bdde571ebc3642892e71ac1ade5

  • SHA1

    f4f0cb78e1c2c5acf88c1cd51f617c13bc3c0708

  • SHA256

    e77948b5a238251a8765acbc392671014fe7298dd177db8262a10c4f4deb5f6f

  • SHA512

    c81e5e4a7aa0e7c6d6303852332e10c17e2ac476bb5d4cedbeda71aba2b2b556fa58e4ed5c94b997bcb56e045c21241384a4fe1becbcbf2f6ffd4e180cdf4de8

  • SSDEEP

    3072:nbLpZuEskJoU4gURKKaacfslyhE03imZ755aL:nbOOJYKKa1fZ5aL

Score
8/10
persistence

Malware Config

Targets

    • Target

      e77948b5a238251a8765acbc392671014fe7298dd177db8262a10c4f4deb5f6f

    • Size

      102KB

    • MD5

      1d9e7bdde571ebc3642892e71ac1ade5

    • SHA1

      f4f0cb78e1c2c5acf88c1cd51f617c13bc3c0708

    • SHA256

      e77948b5a238251a8765acbc392671014fe7298dd177db8262a10c4f4deb5f6f

    • SHA512

      c81e5e4a7aa0e7c6d6303852332e10c17e2ac476bb5d4cedbeda71aba2b2b556fa58e4ed5c94b997bcb56e045c21241384a4fe1becbcbf2f6ffd4e180cdf4de8

    • SSDEEP

      3072:nbLpZuEskJoU4gURKKaacfslyhE03imZ755aL:nbOOJYKKa1fZ5aL

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks