Overview

overview

10

Static

static

d5b7c970e0...f9.exe

windows7-x64

10

d5b7c970e0...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5b7c970e04ae56a1d7f2b096de69d6dd024c1cb6bb4e9c20f6e1fb446c70ff9

  • Size

    704KB

  • Sample

    221205-2e9dqadd39

  • MD5

    01c8ccb0190c4ae2d1aa3bcd40dc3050

  • SHA1

    b885f05169d2a4987a953e6993b1243eba567408

  • SHA256

    d5b7c970e04ae56a1d7f2b096de69d6dd024c1cb6bb4e9c20f6e1fb446c70ff9

  • SHA512

    d8a15c31d78d9349e111eb0b829aff06b92c43cf5aa58965201819053a7f5651a0065aa788475f6d0d76c37d66fb344fcd642b93d8d91038b76a1b54f9ba7962

  • SSDEEP

    12288:WpgvmzFHi0mo5aH0qMzd5807FmPJQPDHvd:WpgvOHi0mGaH0qSdPF44V

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      d5b7c970e04ae56a1d7f2b096de69d6dd024c1cb6bb4e9c20f6e1fb446c70ff9

    • Size

      704KB

    • MD5

      01c8ccb0190c4ae2d1aa3bcd40dc3050

    • SHA1

      b885f05169d2a4987a953e6993b1243eba567408

    • SHA256

      d5b7c970e04ae56a1d7f2b096de69d6dd024c1cb6bb4e9c20f6e1fb446c70ff9

    • SHA512

      d8a15c31d78d9349e111eb0b829aff06b92c43cf5aa58965201819053a7f5651a0065aa788475f6d0d76c37d66fb344fcd642b93d8d91038b76a1b54f9ba7962

    • SSDEEP

      12288:WpgvmzFHi0mo5aH0qMzd5807FmPJQPDHvd:WpgvOHi0mGaH0qSdPF44V

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks