Overview

overview

10

Static

static

edc35736d5...ab.exe

windows7-x64

10

edc35736d5...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edc35736d57f8f3b025ba64cb94f85123b62b73c3dd795df6235edc8f47d00ab

  • Size

    504KB

  • Sample

    221205-f89exsac85

  • MD5

    be3d13f691e348661f833cb0887884db

  • SHA1

    5af090e88891dfadf6a78a7c2caef9cd5875c3d0

  • SHA256

    edc35736d57f8f3b025ba64cb94f85123b62b73c3dd795df6235edc8f47d00ab

  • SHA512

    fadcd7e4d7c76803dbe22f2110ac89ceeab56ffb25b0f78bd8c94d63759f0e7f89036197791d3b3ad0bd9b87ee700ee504c304e01227b97aa86b41037bb2c91a

  • SSDEEP

    12288:22iwn/ND7S3xI66S/H3UyKxWn2hJ+MRmhhhCX:2213Sed0XjhkX

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      edc35736d57f8f3b025ba64cb94f85123b62b73c3dd795df6235edc8f47d00ab

    • Size

      504KB

    • MD5

      be3d13f691e348661f833cb0887884db

    • SHA1

      5af090e88891dfadf6a78a7c2caef9cd5875c3d0

    • SHA256

      edc35736d57f8f3b025ba64cb94f85123b62b73c3dd795df6235edc8f47d00ab

    • SHA512

      fadcd7e4d7c76803dbe22f2110ac89ceeab56ffb25b0f78bd8c94d63759f0e7f89036197791d3b3ad0bd9b87ee700ee504c304e01227b97aa86b41037bb2c91a

    • SSDEEP

      12288:22iwn/ND7S3xI66S/H3UyKxWn2hJ+MRmhhhCX:2213Sed0XjhkX

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks