Overview

overview

10

Static

static

3

13ad678be3...02.exe

windows7-x64

10

13ad678be3...02.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    13ad678be38f827ce646150338890102

  • Size

    240KB

  • Sample

    231225-kz61nagae8

  • MD5

    13ad678be38f827ce646150338890102

  • SHA1

    6e9863053f34e79b8a074de150974c16652b9eef

  • SHA256

    5ae6308b18df308727f893ff7e73ab830585289def50809bbd7033e2a7fc25a2

  • SHA512

    d05dcd55c284ace80f4435ace2b1f75c1ca9e7c5942f94eabef5eddd523ffa2040f48d52152f1c99f29d3d34168473aa084da2e8c41189938398c1eb77d78114

  • SSDEEP

    6144:Moh5UtO7RQjX7XN1kd9JbSDviiopNDa/N08iI/W:Y4xNMW

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      13ad678be38f827ce646150338890102

    • Size

      240KB

    • MD5

      13ad678be38f827ce646150338890102

    • SHA1

      6e9863053f34e79b8a074de150974c16652b9eef

    • SHA256

      5ae6308b18df308727f893ff7e73ab830585289def50809bbd7033e2a7fc25a2

    • SHA512

      d05dcd55c284ace80f4435ace2b1f75c1ca9e7c5942f94eabef5eddd523ffa2040f48d52152f1c99f29d3d34168473aa084da2e8c41189938398c1eb77d78114

    • SSDEEP

      6144:Moh5UtO7RQjX7XN1kd9JbSDviiopNDa/N08iI/W:Y4xNMW

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks