Overview

overview

10

Static

static

156f5bd5da...ec.exe

windows7-x64

10

156f5bd5da...ec.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    156f5bd5da56c6104fdb0d273662d5017803be1569dffac2e9407deedb788dec

  • Size

    557KB

  • Sample

    221206-afkcfadd4s

  • MD5

    bc6379ae1e56146f22c88bf4914a353e

  • SHA1

    afadc381db622b58a86b70a6b80f78ef51fa4259

  • SHA256

    156f5bd5da56c6104fdb0d273662d5017803be1569dffac2e9407deedb788dec

  • SHA512

    2b035caf435aff5f7f55168c6f9e0309f3efb0f67eb9cf2781cbdb9e685fbb09fe52bf2ed41bb8404412c52352bd43c1a1f03f5c3646017e2d8f8960f1b898da

  • SSDEEP

    12288:gr9kbp0xjqQOlh54sfwnzb+CchI8qrWuygQDhXCX:ghkbqxjD2AdzbwIZr0ZDg

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      156f5bd5da56c6104fdb0d273662d5017803be1569dffac2e9407deedb788dec

    • Size

      557KB

    • MD5

      bc6379ae1e56146f22c88bf4914a353e

    • SHA1

      afadc381db622b58a86b70a6b80f78ef51fa4259

    • SHA256

      156f5bd5da56c6104fdb0d273662d5017803be1569dffac2e9407deedb788dec

    • SHA512

      2b035caf435aff5f7f55168c6f9e0309f3efb0f67eb9cf2781cbdb9e685fbb09fe52bf2ed41bb8404412c52352bd43c1a1f03f5c3646017e2d8f8960f1b898da

    • SSDEEP

      12288:gr9kbp0xjqQOlh54sfwnzb+CchI8qrWuygQDhXCX:ghkbqxjD2AdzbwIZr0ZDg

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks