Overview

overview

10

Static

static

3

851b08ee51...39.exe

windows7-x64

10

851b08ee51...39.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    851b08ee51d7efd37fe24a0a203d582de2461b0280c021972dd7beddacd67b39

  • Size

    7.3MB

  • Sample

    231114-xhw6cadb45

  • MD5

    82cf1c1a6e7f52327e4a01651cb22a8d

  • SHA1

    2a57061f724bb650bd961d63cf3e93f60c158eb5

  • SHA256

    851b08ee51d7efd37fe24a0a203d582de2461b0280c021972dd7beddacd67b39

  • SHA512

    89e422babe9e310e10da8c15dd8a33dbc994585b93d0265bce7e14d17cf2b7bb8f5dd5ac072cbd4d69ff0ce3ab2b3a9ec3d3ed024b70b51c1f08cb0e5605d8c4

  • SSDEEP

    12288:2XgvmzFHi0mo5aH0qMzd58c7FcquPJQPDHvd:2XgvOHi0mGaH0qSdDFcT4V

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      851b08ee51d7efd37fe24a0a203d582de2461b0280c021972dd7beddacd67b39

    • Size

      7.3MB

    • MD5

      82cf1c1a6e7f52327e4a01651cb22a8d

    • SHA1

      2a57061f724bb650bd961d63cf3e93f60c158eb5

    • SHA256

      851b08ee51d7efd37fe24a0a203d582de2461b0280c021972dd7beddacd67b39

    • SHA512

      89e422babe9e310e10da8c15dd8a33dbc994585b93d0265bce7e14d17cf2b7bb8f5dd5ac072cbd4d69ff0ce3ab2b3a9ec3d3ed024b70b51c1f08cb0e5605d8c4

    • SSDEEP

      12288:2XgvmzFHi0mo5aH0qMzd58c7FcquPJQPDHvd:2XgvOHi0mGaH0qSdDFcT4V

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks