Overview

overview

10

Static

static

3

IMG001.exe

windows7-x64

10

IMG001.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    IMG001.exe

  • Size

    3.4MB

  • Sample

    230615-pxk3magh8y

  • MD5

    979f00d5eadab60eb68529c990e49896

  • SHA1

    d01397159c414eaf5a7ab0e092c662e8b3a0eadc

  • SHA256

    b21cc3afe552b093b598fc93a023897acd91ebcb8dc045f16463962dcfacf9d0

  • SHA512

    1fe39bd6c786831db279c2e50a095894cf79ac82662cf8167864ec2587e857423e8441a358daa25ade88cb72ab763f0323a0f4b02c8a6864eb3fed786d6f93eb

  • SSDEEP

    98304:MdVPnq1y5tQOM33ZNqCtBixHl54Oyjes1boI:KVPq1yLanrqTr43eSz

Score
10/10
discoverypersistence

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    79.96.170.1
  • Port:
    21
  • Username:
    administrator
  • Password:
    987654321

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    119.51.163.0
  • Port:
    21
  • Username:
    user
  • Password:
    784512

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    49.76.187.3
  • Port:
    21
  • Username:
    admin
  • Password:
    PC123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    1.179.76.7
  • Port:
    21
  • Username:
    user

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    183.181.89.9
  • Port:
    21
  • Username:
    ftp
  • Password:
    iloveyou

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    165.22.62.9
  • Port:
    21
  • Username:
    admin
  • Password:
    VQsaBLPzLa

Targets

    • Target

      IMG001.exe

    • Size

      3.4MB

    • MD5

      979f00d5eadab60eb68529c990e49896

    • SHA1

      d01397159c414eaf5a7ab0e092c662e8b3a0eadc

    • SHA256

      b21cc3afe552b093b598fc93a023897acd91ebcb8dc045f16463962dcfacf9d0

    • SHA512

      1fe39bd6c786831db279c2e50a095894cf79ac82662cf8167864ec2587e857423e8441a358daa25ade88cb72ab763f0323a0f4b02c8a6864eb3fed786d6f93eb

    • SSDEEP

      98304:MdVPnq1y5tQOM33ZNqCtBixHl54Oyjes1boI:KVPq1yLanrqTr43eSz

    Score
    10/10
    persistencediscovery

    • Contacts a large (885) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks