c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9 | Triage

Submit
Reports

Overview

overview

8

Static

static

3

c457841b13...b9.exe

windows7-x64

8

c457841b13...b9.exe

windows10-2004-x64

8

Sharing

General

Target

c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9
Size

5.9MB
Sample

231013-2vcdxsfh79
MD5

346559284889fd9dc6488ea81019ea82
SHA1

81cb283af4bcf6857a996ffb5bb657563473abfd
SHA256

c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9
SHA512

0c64a90d4362b989c21708235f3f5fa70fb937515fe2382a51ea7b64757c57a0289478f4b1b849f6f68b1b6c70f642cbc5221b589b4b7f5a2d9800c15c14b716
SSDEEP

98304:VjD5tGDmjdZw5U2FSvv7wwpykq7THO10H9qpQeORdwKuCkpauv00j41dkTt:VjDnGDmjU5jc8wYECeORwv00j4y

Score

8^/10

discovery evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9.exe

Resource

win7-20230831-en

discovery evasion persistence trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9.exe

Resource

win10v2004-20230915-en

discovery persistence

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9
- Size
  
  5.9MB
- MD5
  
  346559284889fd9dc6488ea81019ea82
- SHA1
  
  81cb283af4bcf6857a996ffb5bb657563473abfd
- SHA256
  
  c457841b131178e2bea969f400aee98c93d939607b9be8a0139a7f1980d386b9
- SHA512
  
  0c64a90d4362b989c21708235f3f5fa70fb937515fe2382a51ea7b64757c57a0289478f4b1b849f6f68b1b6c70f642cbc5221b589b4b7f5a2d9800c15c14b716
- SSDEEP
  
  98304:VjD5tGDmjdZw5U2FSvv7wwpykq7THO10H9qpQeORdwKuCkpauv00j41dkTt:VjDnGDmjU5jc8wYECeORwv00j4y
Score

8^/10

discovery evasion persistence trojan
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoverypersistence

© 2018-2025

Terms | Privacy