Overview

overview

8

Static

static

3

Loader_Setup.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader_Setup.exe

  • Size

    351KB

  • Sample

    231230-2h3eksdcdl

  • MD5

    584103ac515dfbbef3e6d9152c48aad1

  • SHA1

    a20045c8033c5e7472bda9d314ecf428f82e5ead

  • SHA256

    89e2878d0a774e09950388d581f75fe27264bc818ea725afd4403ecfa9dcf729

  • SHA512

    dbd04e48dd904691aa2ca7a569991129267c234d0275899c58c1de56e7103ad01c7de466619d2f65c29bacd61938c27161c492fe245078aa1e0e027cdc0f3995

  • SSDEEP

    6144:r7eX8oqDS7csBY16m+z7kVtYflqIQ34tgJCj/mKd36RSPzGGPG:GqEGKk7YdqEtgujtG

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      Loader_Setup.exe

    • Size

      351KB

    • MD5

      584103ac515dfbbef3e6d9152c48aad1

    • SHA1

      a20045c8033c5e7472bda9d314ecf428f82e5ead

    • SHA256

      89e2878d0a774e09950388d581f75fe27264bc818ea725afd4403ecfa9dcf729

    • SHA512

      dbd04e48dd904691aa2ca7a569991129267c234d0275899c58c1de56e7103ad01c7de466619d2f65c29bacd61938c27161c492fe245078aa1e0e027cdc0f3995

    • SSDEEP

      6144:r7eX8oqDS7csBY16m+z7kVtYflqIQ34tgJCj/mKd36RSPzGGPG:GqEGKk7YdqEtgujtG

    Score
    8/10
    discoverypersistence

    • Downloads MZ/PE file

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks