Overview

overview

7

Static

static

3

a79219ee05...7b.exe

windows7-x64

7

a79219ee05...7b.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    a79219ee055d1c1af144dd003891eb04d4778e231c5f81ac8eac594c04f4e87b

  • Size

    170KB

  • Sample

    240422-bw7y4sdh8s

  • MD5

    98e0b46ac41f4ff85a9d1a4bc2e05bfb

  • SHA1

    586092618be5f9315d9ffcfcb3eff3f90b9f677a

  • SHA256

    a79219ee055d1c1af144dd003891eb04d4778e231c5f81ac8eac594c04f4e87b

  • SHA512

    73e59aa57699e72e4e3b84ccdeff17514f2c2d7c243e3d1a11a0469f4b4f2bc78d5859b31e0790915f9a80567d179761fffb549b1399d1a17e9dd8aaa3a51de1

  • SSDEEP

    3072:9JpOm5axh63laEo+pXX1pQD2UCohD8mxLCj+5cmeDye42L712xrpdJ8xLeb7UD:zAm5oh63laEo+pXX1pkF8mxeq5+4m713

Score
7/10

Malware Config

Targets

    • Target

      a79219ee055d1c1af144dd003891eb04d4778e231c5f81ac8eac594c04f4e87b

    • Size

      170KB

    • MD5

      98e0b46ac41f4ff85a9d1a4bc2e05bfb

    • SHA1

      586092618be5f9315d9ffcfcb3eff3f90b9f677a

    • SHA256

      a79219ee055d1c1af144dd003891eb04d4778e231c5f81ac8eac594c04f4e87b

    • SHA512

      73e59aa57699e72e4e3b84ccdeff17514f2c2d7c243e3d1a11a0469f4b4f2bc78d5859b31e0790915f9a80567d179761fffb549b1399d1a17e9dd8aaa3a51de1

    • SSDEEP

      3072:9JpOm5axh63laEo+pXX1pQD2UCohD8mxLCj+5cmeDye42L712xrpdJ8xLeb7UD:zAm5oh63laEo+pXX1pkF8mxeq5+4m713

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks