General

  • Target

    b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

  • Size

    120KB

  • Sample

    230129-l5bx5sca6z

  • MD5

    00a9e76cd50f13a7824ea09947434c2d

  • SHA1

    8e2a5aa7ddbd96c4347be109dd4191aa8f1f703c

  • SHA256

    b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

  • SHA512

    7f0ec8268bd7bbf76e9c002d32dae82db0da1239180680ee1ab43871f2414f443a1c8843aec0b8e9c289a3b4414674843b774f195b45d60a4ebbca91e8e1f9b9

  • SSDEEP

    3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnm:h+3fRb9NdndPZMTs

Malware Config

Targets

    • Target

      b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

    • Size

      120KB

    • MD5

      00a9e76cd50f13a7824ea09947434c2d

    • SHA1

      8e2a5aa7ddbd96c4347be109dd4191aa8f1f703c

    • SHA256

      b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

    • SHA512

      7f0ec8268bd7bbf76e9c002d32dae82db0da1239180680ee1ab43871f2414f443a1c8843aec0b8e9c289a3b4414674843b774f195b45d60a4ebbca91e8e1f9b9

    • SSDEEP

      3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnm:h+3fRb9NdndPZMTs

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • UAC bypass

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

4
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks