General
-
Target
01d090802835895bc7c3a6860115c730.exe.bin.exe
-
Size
120KB
-
Sample
240518-lzdvjsec7w
-
MD5
01d090802835895bc7c3a6860115c730
-
SHA1
bb598478345187510263c2c2077764c00ab7bd50
-
SHA256
79e563193f0e1c271a4e7355fb2689e0f107477e2220aaba8af7a735e2a06c72
-
SHA512
de07da9f781028087835bb9dd24439a3eba28f87f9e0525c653e6eee0170a2d6077486168f6f861db6af2056039ea35bc8ab3b200aa4197a0bbed0881e0fbd13
-
SSDEEP
3072:3HFMoPetZLNacwvRkFkIoE6FBgJyINi1QUfHOMr0E:33SZTwvRkyBdFBgotHOMr
Static task
static1
Behavioral task
behavioral1
Sample
01d090802835895bc7c3a6860115c730.exe.bin.dll
Resource
win7-20240220-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
01d090802835895bc7c3a6860115c730.exe.bin.exe
-
Size
120KB
-
MD5
01d090802835895bc7c3a6860115c730
-
SHA1
bb598478345187510263c2c2077764c00ab7bd50
-
SHA256
79e563193f0e1c271a4e7355fb2689e0f107477e2220aaba8af7a735e2a06c72
-
SHA512
de07da9f781028087835bb9dd24439a3eba28f87f9e0525c653e6eee0170a2d6077486168f6f861db6af2056039ea35bc8ab3b200aa4197a0bbed0881e0fbd13
-
SSDEEP
3072:3HFMoPetZLNacwvRkFkIoE6FBgJyINi1QUfHOMr0E:33SZTwvRkyBdFBgotHOMr
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3