Overview

overview

10

Static

static

41c1422bcb...98.exe

windows7-x64

10

41c1422bcb...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41c1422bcbf61140a1ad988e228c34c6a96b8cb0a8271deba35ca86c82119b98

  • Size

    88KB

  • Sample

    221203-yjkz5sad64

  • MD5

    29a952e7458ce407e1293d967eb62940

  • SHA1

    0c694a87267f95a7f616a4a2b4431a4f0d769bc3

  • SHA256

    41c1422bcbf61140a1ad988e228c34c6a96b8cb0a8271deba35ca86c82119b98

  • SHA512

    af8d2173d8e72a7df6e0db462471b8f79c1a43abbd3a056f2db39d0f56dc88a9755454d73609573d76ac8e8a44bfdc57763482791d259beee466b132611f737e

  • SSDEEP

    1536:eUQZEfhQIKKF35FQo6uxmstkXEB/PRiv9yaBdkM6WY2Iugm5QZj+lYWHzq7N:7fi9Knhtt9pPSZY2ngCQhcYWHe7N

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      41c1422bcbf61140a1ad988e228c34c6a96b8cb0a8271deba35ca86c82119b98

    • Size

      88KB

    • MD5

      29a952e7458ce407e1293d967eb62940

    • SHA1

      0c694a87267f95a7f616a4a2b4431a4f0d769bc3

    • SHA256

      41c1422bcbf61140a1ad988e228c34c6a96b8cb0a8271deba35ca86c82119b98

    • SHA512

      af8d2173d8e72a7df6e0db462471b8f79c1a43abbd3a056f2db39d0f56dc88a9755454d73609573d76ac8e8a44bfdc57763482791d259beee466b132611f737e

    • SSDEEP

      1536:eUQZEfhQIKKF35FQo6uxmstkXEB/PRiv9yaBdkM6WY2Iugm5QZj+lYWHzq7N:7fi9Knhtt9pPSZY2ngCQhcYWHe7N

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks