General
-
Target
05e18159486bf037d3b28317a7268710.exe.bin.exe
-
Size
120KB
-
Sample
240518-mbzyjseg27
-
MD5
05e18159486bf037d3b28317a7268710
-
SHA1
cb1c43d6296177f8aa04defaf68ba8a9e879ecd8
-
SHA256
b23e8b82fc82399c8aa50a86f8f592fa689ad3841dcc80a49b01e35bb3caea79
-
SHA512
3f3582a794efbffc755960fbe1e925b12d5f90222843b4fca756c724db9bbb727cff549499dc49f06d98caa7274c52a1a8785ae860d0edac55fd70c32e4114bf
-
SSDEEP
3072:fNd7a82lh8+YYZ813i2vZjs9eRjcL12ik:ff7wX8+YYZ8oyjcQjc0ik
Static task
static1
Behavioral task
behavioral1
Sample
05e18159486bf037d3b28317a7268710.exe.bin.dll
Resource
win7-20240508-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
05e18159486bf037d3b28317a7268710.exe.bin.exe
-
Size
120KB
-
MD5
05e18159486bf037d3b28317a7268710
-
SHA1
cb1c43d6296177f8aa04defaf68ba8a9e879ecd8
-
SHA256
b23e8b82fc82399c8aa50a86f8f592fa689ad3841dcc80a49b01e35bb3caea79
-
SHA512
3f3582a794efbffc755960fbe1e925b12d5f90222843b4fca756c724db9bbb727cff549499dc49f06d98caa7274c52a1a8785ae860d0edac55fd70c32e4114bf
-
SSDEEP
3072:fNd7a82lh8+YYZ813i2vZjs9eRjcL12ik:ff7wX8+YYZ8oyjcQjc0ik
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3