Overview

overview

10

Static

static

ba4e1d8b9a...21.exe

windows7-x64

10

ba4e1d8b9a...21.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ba4e1d8b9a820bc27429fe92f9273ec68a51e4d282fa1b12d56ba3c832379021

  • Size

    208KB

  • Sample

    221205-lfansaba6s

  • MD5

    a2315bafca4a5a42547159dcb9b78961

  • SHA1

    4a70932927162c4068a7749834909c99c77cd025

  • SHA256

    ba4e1d8b9a820bc27429fe92f9273ec68a51e4d282fa1b12d56ba3c832379021

  • SHA512

    ed323034dc04703e851a66d6b63a463df568e901ed7588be2e12c335c5d2ab866ae4c73471054d7cfb813437802ebbcbf894ca5cad0c729fe1d2bc965790ea35

  • SSDEEP

    3072:RDMM1+QDZ979aAqvxpDWDhQx9AhHp8NeqxEN1yy8p+uMn/a:R5+aoA8pDqQx9AhJSRxiJ8jc/a

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      ba4e1d8b9a820bc27429fe92f9273ec68a51e4d282fa1b12d56ba3c832379021

    • Size

      208KB

    • MD5

      a2315bafca4a5a42547159dcb9b78961

    • SHA1

      4a70932927162c4068a7749834909c99c77cd025

    • SHA256

      ba4e1d8b9a820bc27429fe92f9273ec68a51e4d282fa1b12d56ba3c832379021

    • SHA512

      ed323034dc04703e851a66d6b63a463df568e901ed7588be2e12c335c5d2ab866ae4c73471054d7cfb813437802ebbcbf894ca5cad0c729fe1d2bc965790ea35

    • SSDEEP

      3072:RDMM1+QDZ979aAqvxpDWDhQx9AhHp8NeqxEN1yy8p+uMn/a:R5+aoA8pDqQx9AhJSRxiJ8jc/a

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks