Overview

overview

8

Static

static

3

6562e2ac60...82.exe

windows7-x64

8

6562e2ac60...82.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe

  • Size

    87KB

  • Sample

    230602-kw669aaf75

  • MD5

    a579d53a1d29684de6d2c0cbabd525c5

  • SHA1

    17661a04b4b150a6f70afdabe3fd9839cc56bee8

  • SHA256

    6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82

  • SHA512

    a98456792d7f7c83d0fe6be3ce6c48a4630a073b456848e0c8f614efe292a24fcf8d879ead5f2b418e5e29f46ae9356691383ba57e6066c5cacc0d47e675f817

  • SSDEEP

    1536:PwjBg7Rj2r+65ofVkOu2avMtRsCtQqES1IVSJjXTmgacggNp:YjBY12G7uJvMnsGQhSYEmgacx

Score
8/10
persistence

Malware Config

Targets

    • Target

      6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe

    • Size

      87KB

    • MD5

      a579d53a1d29684de6d2c0cbabd525c5

    • SHA1

      17661a04b4b150a6f70afdabe3fd9839cc56bee8

    • SHA256

      6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82

    • SHA512

      a98456792d7f7c83d0fe6be3ce6c48a4630a073b456848e0c8f614efe292a24fcf8d879ead5f2b418e5e29f46ae9356691383ba57e6066c5cacc0d47e675f817

    • SSDEEP

      1536:PwjBg7Rj2r+65ofVkOu2avMtRsCtQqES1IVSJjXTmgacggNp:YjBY12G7uJvMnsGQhSYEmgacx

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks