Overview

overview

8

Static

static

3

20362d4799...29.exe

windows7-x64

8

20362d4799...29.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    20362d4799627e87538e7eda9c6b248ccc698c0a62639ef05e6455c69f537b29

  • Size

    632KB

  • Sample

    230902-bqqsmsae6s

  • MD5

    32f941f0445022a7141fc816d212b6d4

  • SHA1

    f731d47ee9e7b79ae69fe94dc22aaf4f6ff4da1f

  • SHA256

    20362d4799627e87538e7eda9c6b248ccc698c0a62639ef05e6455c69f537b29

  • SHA512

    d009e384821968b7740ecf4d95670a3fd033f160d151acc87699e927c7720646730cb92f0e701d4e1c18cfe2c090ad12f011ad418103ee727961c85ff885f25f

  • SSDEEP

    12288:q/iSuokQiMXBLfzYjnlJE1xl444clzKbtDf4TclbwO0dJYPjfWrhrn:q/iUbVKnHEva4plzKxT4TclEO0yjM7

Score
8/10
persistence

Malware Config

Targets

    • Target

      20362d4799627e87538e7eda9c6b248ccc698c0a62639ef05e6455c69f537b29

    • Size

      632KB

    • MD5

      32f941f0445022a7141fc816d212b6d4

    • SHA1

      f731d47ee9e7b79ae69fe94dc22aaf4f6ff4da1f

    • SHA256

      20362d4799627e87538e7eda9c6b248ccc698c0a62639ef05e6455c69f537b29

    • SHA512

      d009e384821968b7740ecf4d95670a3fd033f160d151acc87699e927c7720646730cb92f0e701d4e1c18cfe2c090ad12f011ad418103ee727961c85ff885f25f

    • SSDEEP

      12288:q/iSuokQiMXBLfzYjnlJE1xl444clzKbtDf4TclbwO0dJYPjfWrhrn:q/iUbVKnHEva4plzKxT4TclEO0yjM7

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks