Overview

overview

8

Static

static

f0692579b8...5a.exe

windows7-x64

8

f0692579b8...5a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0692579b824d1683a854e1e9782688fcb0681f20c0081d7d5933b7e544a0c5a

  • Size

    262KB

  • Sample

    221205-by4z8sde58

  • MD5

    6766095449730cf678ff9e5b4e368701

  • SHA1

    bc93c3d2b26b49a0787d6fae3789a201857299d1

  • SHA256

    f0692579b824d1683a854e1e9782688fcb0681f20c0081d7d5933b7e544a0c5a

  • SHA512

    99a3cfbb0391f59795d16334c75a00e4a70c55337e0838c6da80c4be005faf0429934bc0ac2102e38b4b750abb53bd5142be63bccec37f250990be5927a708f3

  • SSDEEP

    6144:gSYuT4ElbtEtK8E4fESnFBkARgIDxdW+DtTwjjW:gU4ElJIE6PXRgIFQ60

Score
8/10
persistence

Malware Config

Targets

    • Target

      f0692579b824d1683a854e1e9782688fcb0681f20c0081d7d5933b7e544a0c5a

    • Size

      262KB

    • MD5

      6766095449730cf678ff9e5b4e368701

    • SHA1

      bc93c3d2b26b49a0787d6fae3789a201857299d1

    • SHA256

      f0692579b824d1683a854e1e9782688fcb0681f20c0081d7d5933b7e544a0c5a

    • SHA512

      99a3cfbb0391f59795d16334c75a00e4a70c55337e0838c6da80c4be005faf0429934bc0ac2102e38b4b750abb53bd5142be63bccec37f250990be5927a708f3

    • SSDEEP

      6144:gSYuT4ElbtEtK8E4fESnFBkARgIDxdW+DtTwjjW:gU4ElJIE6PXRgIFQ60

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks