Overview

overview

8

Static

static

1

64f598cd65...4c.exe

windows7-x64

8

64f598cd65...4c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64f598cd65cc6c9a0848a5559dede603521a3bf070f58b128a310dcc0a2bf34c

  • Size

    25.3MB

  • Sample

    230317-kkdessfb73

  • MD5

    283bb4df34e7d563524d20284342960a

  • SHA1

    5328ef3bf63c1ee9cb85334d0b8ce13496dd20dd

  • SHA256

    64f598cd65cc6c9a0848a5559dede603521a3bf070f58b128a310dcc0a2bf34c

  • SHA512

    613966058ce4eddb823cd864a457af4ba2c658dd1e6fb20b706b6af99e1b8f2bdbbae32ac8d70bf4806c77822d2a7148e7de7da8fa75ef70eb6166d30e9c822c

  • SSDEEP

    786432:nHI+vGaZwTxuAsquJyZBX6gBz0AAl7X3ZcRJz:nHTeEwTxEBJyugCWz

Score
8/10
discoveryevasionexploitpersistence

Malware Config

Targets

    • Target

      64f598cd65cc6c9a0848a5559dede603521a3bf070f58b128a310dcc0a2bf34c

    • Size

      25.3MB

    • MD5

      283bb4df34e7d563524d20284342960a

    • SHA1

      5328ef3bf63c1ee9cb85334d0b8ce13496dd20dd

    • SHA256

      64f598cd65cc6c9a0848a5559dede603521a3bf070f58b128a310dcc0a2bf34c

    • SHA512

      613966058ce4eddb823cd864a457af4ba2c658dd1e6fb20b706b6af99e1b8f2bdbbae32ac8d70bf4806c77822d2a7148e7de7da8fa75ef70eb6166d30e9c822c

    • SSDEEP

      786432:nHI+vGaZwTxuAsquJyZBX6gBz0AAl7X3ZcRJz:nHTeEwTxEBJyugCWz

    Score
    8/10
    discoveryevasionexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks