Overview

overview

8

Static

static

ed8a4cf3fe...78.exe

windows7-x64

8

ed8a4cf3fe...78.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278

  • Size

    367KB

  • Sample

    221204-wf624acb69

  • MD5

    bbf0bfc80cf742e1f19e7e053e78b2fb

  • SHA1

    9010f6087f50555b16219a40a03943bca3002970

  • SHA256

    ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278

  • SHA512

    2f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c

  • SSDEEP

    6144:JKVtzpAShNxvAg/j4oEDjmTyZC6dIffK6uINK6Fwgd8yf9C:JKVtp7vXj4oE2uZC6d6fKuAOxh

Score
8/10
persistence

Malware Config

Targets

    • Target

      ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278

    • Size

      367KB

    • MD5

      bbf0bfc80cf742e1f19e7e053e78b2fb

    • SHA1

      9010f6087f50555b16219a40a03943bca3002970

    • SHA256

      ed8a4cf3fec6e81a6b4501c2b22ec4274e0dec2e92d98413fdfb8ff85e6ef278

    • SHA512

      2f2f7dde23733066c8e0050902f1eb544d47ddbac6dc033339ad37e7f0cd80d13d68df7a47e68746d24168905de8715a224a7db5438658eaa1d0ac27283f180c

    • SSDEEP

      6144:JKVtzpAShNxvAg/j4oEDjmTyZC6dIffK6uINK6Fwgd8yf9C:JKVtp7vXj4oE2uZC6d6fKuAOxh

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks