Overview

overview

8

Static

static

e55eb98432...b9.exe

windows7-x64

8

e55eb98432...b9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e55eb9843202d21f9b3a4b88c6ccfa107ebb73abad8a232a7bda8dc91d7eccb9

  • Size

    93KB

  • Sample

    221206-lslltafa83

  • MD5

    16169a7ff4f0619b0e22df4313d993b0

  • SHA1

    b9ef558d7b753a38d6b367d28d49e4fb9b5f2834

  • SHA256

    e55eb9843202d21f9b3a4b88c6ccfa107ebb73abad8a232a7bda8dc91d7eccb9

  • SHA512

    ed2850dce57ea1412e9753e0d5f89bb39c7e55a741b391eb2a24dd8cbc6ec8a39d5be07b8f843939ee7c94cced29604e195e01db4bbb5290201449a8edb256e3

  • SSDEEP

    1536:JRVneKG3nVXyakJ+lZArw8j7B2NLe/2XjSXAVlyPh8HCeqQ/u:JRVngVAJ+lZArV3B2N6YjSXAPiKu

Score
8/10
discoveryexploit

Malware Config

Targets

    • Target

      e55eb9843202d21f9b3a4b88c6ccfa107ebb73abad8a232a7bda8dc91d7eccb9

    • Size

      93KB

    • MD5

      16169a7ff4f0619b0e22df4313d993b0

    • SHA1

      b9ef558d7b753a38d6b367d28d49e4fb9b5f2834

    • SHA256

      e55eb9843202d21f9b3a4b88c6ccfa107ebb73abad8a232a7bda8dc91d7eccb9

    • SHA512

      ed2850dce57ea1412e9753e0d5f89bb39c7e55a741b391eb2a24dd8cbc6ec8a39d5be07b8f843939ee7c94cced29604e195e01db4bbb5290201449a8edb256e3

    • SSDEEP

      1536:JRVneKG3nVXyakJ+lZArw8j7B2NLe/2XjSXAVlyPh8HCeqQ/u:JRVngVAJ+lZArV3B2N6YjSXAPiKu

    Score
    8/10
    discoveryexploit

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks