Overview

overview

7

Static

static

3

6daddcc41e...a5.exe

windows7-x64

7

6daddcc41e...a5.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6daddcc41e60864ddcc398feb869cd2a7bf79939498aaa4febd2c47d6bf993a5

  • Size

    455KB

  • Sample

    240305-1hgx7sba93

  • MD5

    ea618b542a89a36d9292596ffd6c2a18

  • SHA1

    59e518e3d449a1b1c11d3a740193510f39d83729

  • SHA256

    6daddcc41e60864ddcc398feb869cd2a7bf79939498aaa4febd2c47d6bf993a5

  • SHA512

    da77609ebeaf730cb4c94fba5d3e033db37c872ff470cbdd4b51222239ca0a23a324c807c6e816dfd6630749c79ee6a09b0215150637313f2baf1c3c4df00fe6

  • SSDEEP

    6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8ALpIh9jil:5pQD+mO5KWy/zrVbt4fcYD9U9jI

Score
7/10
persistence

Malware Config

Targets

    • Target

      6daddcc41e60864ddcc398feb869cd2a7bf79939498aaa4febd2c47d6bf993a5

    • Size

      455KB

    • MD5

      ea618b542a89a36d9292596ffd6c2a18

    • SHA1

      59e518e3d449a1b1c11d3a740193510f39d83729

    • SHA256

      6daddcc41e60864ddcc398feb869cd2a7bf79939498aaa4febd2c47d6bf993a5

    • SHA512

      da77609ebeaf730cb4c94fba5d3e033db37c872ff470cbdd4b51222239ca0a23a324c807c6e816dfd6630749c79ee6a09b0215150637313f2baf1c3c4df00fe6

    • SSDEEP

      6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8ALpIh9jil:5pQD+mO5KWy/zrVbt4fcYD9U9jI

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks