Overview

overview

10

Static

static

3

58079fa79c...eb.exe

windows7-x64

10

58079fa79c...eb.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    58079fa79c6d9cd01b097dc4affccfd4790ca67d34c0da53604c4a51d2c66ceb

  • Size

    9.3MB

  • Sample

    240529-1sln5sca59

  • MD5

    233d5e6e3510a971211f490f3c5ac05b

  • SHA1

    04cdd97b598c3ecbccf3349392cd81195e531c9d

  • SHA256

    58079fa79c6d9cd01b097dc4affccfd4790ca67d34c0da53604c4a51d2c66ceb

  • SHA512

    5eff28b0f28a747a537030a7027bda85481282a8de49d895d9818e8da3c568df03ee29830d53bcbd205a90e9155f455141ee56db754da4ab8117cad6fb5c4e12

  • SSDEEP

    6144:w1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqBQFHgTE86JQPDHDdx/Qtqa:NOkiCpat4FU6JXKqmZgEPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      58079fa79c6d9cd01b097dc4affccfd4790ca67d34c0da53604c4a51d2c66ceb

    • Size

      9.3MB

    • MD5

      233d5e6e3510a971211f490f3c5ac05b

    • SHA1

      04cdd97b598c3ecbccf3349392cd81195e531c9d

    • SHA256

      58079fa79c6d9cd01b097dc4affccfd4790ca67d34c0da53604c4a51d2c66ceb

    • SHA512

      5eff28b0f28a747a537030a7027bda85481282a8de49d895d9818e8da3c568df03ee29830d53bcbd205a90e9155f455141ee56db754da4ab8117cad6fb5c4e12

    • SSDEEP

      6144:w1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqBQFHgTE86JQPDHDdx/Qtqa:NOkiCpat4FU6JXKqmZgEPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks