Overview

overview

10

Static

static

83de08f484...95.exe

windows7-x64

10

83de08f484...95.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    83de08f484302d2a00a42cd0ce79bbdbdcab51d4d8a87d14b434136b8fa16195

  • Size

    500KB

  • Sample

    221205-n23mssgb49

  • MD5

    7f1f8de5b4b569c182bfe60b293b1812

  • SHA1

    82f31b92c999c490d4752e354e8647df6233adc1

  • SHA256

    83de08f484302d2a00a42cd0ce79bbdbdcab51d4d8a87d14b434136b8fa16195

  • SHA512

    cd71c8c0a19bb76d56f0a70e63b7b7a8b44efe7d5b65096fb6b56a73ac44bcbc173d9dfe22c1d7d0d2cba04e233e094c9a5ecf3bdb50d404c4db0614172c1c53

  • SSDEEP

    12288:36bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgWd5:YvdezCByqTtlMQsFuqzRbzI7In

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      83de08f484302d2a00a42cd0ce79bbdbdcab51d4d8a87d14b434136b8fa16195

    • Size

      500KB

    • MD5

      7f1f8de5b4b569c182bfe60b293b1812

    • SHA1

      82f31b92c999c490d4752e354e8647df6233adc1

    • SHA256

      83de08f484302d2a00a42cd0ce79bbdbdcab51d4d8a87d14b434136b8fa16195

    • SHA512

      cd71c8c0a19bb76d56f0a70e63b7b7a8b44efe7d5b65096fb6b56a73ac44bcbc173d9dfe22c1d7d0d2cba04e233e094c9a5ecf3bdb50d404c4db0614172c1c53

    • SSDEEP

      12288:36bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgWd5:YvdezCByqTtlMQsFuqzRbzI7In

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks