General

  • Target

    XAU.exe

  • Size

    7.2MB

  • Sample

    240221-p4hk3sgb25

  • MD5

    13d9b5407ee50020e96defc3a7139561

  • SHA1

    ba16b3035d1d76aeef75ae0b167e762a2ebe3a09

  • SHA256

    fd12ca853eff20538727c03a179568eb32858438312c4e8fc7fb66b0051266b7

  • SHA512

    e6cc4f1128597ff6827255208494cdaa5e77e9be22bec22e94e7a097c030874c1dfbbecfd98032bd9f294975e09f47c2be0ae07055b58b2427ff45f1f30c7aa3

  • SSDEEP

    98304:z5jj7mOYoXyI/PLCvSmaRT+BcPNRZ5h5AHDfyRr8l5n:V37mOzyQNNRZK

Malware Config

Targets

    • Target

      XAU.exe

    • Size

      7.2MB

    • MD5

      13d9b5407ee50020e96defc3a7139561

    • SHA1

      ba16b3035d1d76aeef75ae0b167e762a2ebe3a09

    • SHA256

      fd12ca853eff20538727c03a179568eb32858438312c4e8fc7fb66b0051266b7

    • SHA512

      e6cc4f1128597ff6827255208494cdaa5e77e9be22bec22e94e7a097c030874c1dfbbecfd98032bd9f294975e09f47c2be0ae07055b58b2427ff45f1f30c7aa3

    • SSDEEP

      98304:z5jj7mOYoXyI/PLCvSmaRT+BcPNRZ5h5AHDfyRr8l5n:V37mOzyQNNRZK

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks