Overview

overview

10

Static

static

c65ddbb09d...18.exe

windows7-x64

10

c65ddbb09d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c65ddbb09ddffe7a98a71014f1a5609f1c7e4da3406102e974d985d4a320fd18

  • Size

    264KB

  • Sample

    221203-nag7sahf5t

  • MD5

    1f4cb64ee3557e330623f0a13bd65210

  • SHA1

    c7737115f9643e1c5d7deeff516c7d557898719c

  • SHA256

    c65ddbb09ddffe7a98a71014f1a5609f1c7e4da3406102e974d985d4a320fd18

  • SHA512

    1c013409f6089c9fe626dd69ddf073938d1cebea80b6d7f84e2b33cb6a7d94ac5fb90b47cd48293a66e7c42b19ed66bb2ab412203423b3c0e746caf4db98f7cb

  • SSDEEP

    3072:CkWL5tpQ2CSA1AAPoCpxW5ATBfUNjpSEfsPxXu/SOoeNP+2DYM6DjH39TCkunYor:WtpsoCpcNQ7H

Score
10/10
persistence

Malware Config

Targets

    • Target

      c65ddbb09ddffe7a98a71014f1a5609f1c7e4da3406102e974d985d4a320fd18

    • Size

      264KB

    • MD5

      1f4cb64ee3557e330623f0a13bd65210

    • SHA1

      c7737115f9643e1c5d7deeff516c7d557898719c

    • SHA256

      c65ddbb09ddffe7a98a71014f1a5609f1c7e4da3406102e974d985d4a320fd18

    • SHA512

      1c013409f6089c9fe626dd69ddf073938d1cebea80b6d7f84e2b33cb6a7d94ac5fb90b47cd48293a66e7c42b19ed66bb2ab412203423b3c0e746caf4db98f7cb

    • SSDEEP

      3072:CkWL5tpQ2CSA1AAPoCpxW5ATBfUNjpSEfsPxXu/SOoeNP+2DYM6DjH39TCkunYor:WtpsoCpcNQ7H

    Score
    10/10
    persistence

    • Modifies system executable filetype association

      persistence

    • Adds policy Run key to start application

      persistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks