c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b | Triage

Submit
Reports

Overview

overview

6

Static

static

1

c2d04ac557...7b.exe

windows7-x64

6

c2d04ac557...7b.exe

windows10-2004-x64

6

Sharing

General

Target

c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
Size

4.6MB
Sample

240314-kqej2sfc81
MD5

b090d2f2f22eb863bc1b19c0ce9d24ba
SHA1

92d2469466f72e05bfd1be8665673b46a8523077
SHA256

c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
SHA512

a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312
SSDEEP

98304:J6vseEXOI6YbJ8JP6yabDMTwS8g2ZFmu2BftJJmVYobBb0:UiJ6bP5Mg2HQJWnF0

Score

6^/10

discovery evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b.exe

Resource

win7-20240221-en

discovery evasion persistence trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b.exe

Resource

win10v2004-20240226-en

discovery evasion persistence trojan

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
- Size
  
  4.6MB
- MD5
  
  b090d2f2f22eb863bc1b19c0ce9d24ba
- SHA1
  
  92d2469466f72e05bfd1be8665673b46a8523077
- SHA256
  
  c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b
- SHA512
  
  a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312
- SSDEEP
  
  98304:J6vseEXOI6YbJ8JP6yabDMTwS8g2ZFmu2BftJJmVYobBb0:UiJ6bP5Mg2HQJWnF0
Score

6^/10

discovery evasion persistence trojan
- Checks whether UAC is enabled
  evasion trojan
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan

© 2018-2024

Terms | Privacy