Overview

overview

10

Static

static

3

0de36d4587...94.exe

windows7-x64

10

0de36d4587...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0de36d458764902ed28c20d819799294

  • Size

    1.6MB

  • Sample

    231230-ephmesccc3

  • MD5

    0de36d458764902ed28c20d819799294

  • SHA1

    1daa58806a168d5bd05c97debd20747f5524fb6b

  • SHA256

    338f896dd44b913fc10b59b4fec6325b3fbec5d491f5d6164ef4b5ceb1988389

  • SHA512

    b9d1095b2211bcbe6c07a32a69371d2da726fce7b33627d20e73521291eb02608da0550215af46a2f02ae56318251d858b3dbd3ee6a2a0e04148b0f2a9106f46

  • SSDEEP

    49152:/ZJqBtoDdfOeOlUArKJYQ+kzKcOU7m6G2:hJqBoddOkJYQ+k9OU7G2

Score
10/10
evasionpersistence

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://6a8fb8de2865eed9.pc-shieldonline.com/favicon.ico?0=72&1=0&2=2&3=100&4=i-s&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=thchmlakja

Extracted

Language
hta
Source
URLs
hta.dropper

http://6a8fb8de2865eed9.pc-shieldonline.com/favicon.ico?0=72&1=0&2=2&3=100&4=i-s&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=bpucdiyhnw

Targets

    • Target

      0de36d458764902ed28c20d819799294

    • Size

      1.6MB

    • MD5

      0de36d458764902ed28c20d819799294

    • SHA1

      1daa58806a168d5bd05c97debd20747f5524fb6b

    • SHA256

      338f896dd44b913fc10b59b4fec6325b3fbec5d491f5d6164ef4b5ceb1988389

    • SHA512

      b9d1095b2211bcbe6c07a32a69371d2da726fce7b33627d20e73521291eb02608da0550215af46a2f02ae56318251d858b3dbd3ee6a2a0e04148b0f2a9106f46

    • SSDEEP

      49152:/ZJqBtoDdfOeOlUArKJYQ+kzKcOU7m6G2:hJqBoddOkJYQ+k9OU7G2

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Sets file execution options in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks