Overview

overview

8

Static

static

3

$77XD.exe

windows7-x64

8

$77XD.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    $77XD.exe

  • Size

    41KB

  • Sample

    240601-jbyhyaeg94

  • MD5

    2ae06f9b3b5a3f18090ab9e94c9a634f

  • SHA1

    9a99637ddd19922f735532dcedce205a3f0502e3

  • SHA256

    197031b846e5375fbc859df86bc2746e0583dce86d261c23cab72693b820473e

  • SHA512

    45ed777202c6b907e79c79bd877add0d36db2854e29692ab346c4f2822b8453c0afd8aa1c655adc268b71204916db71e4cbebbfbc724dde255d950b43f9feb05

  • SSDEEP

    768:is7PAsxblBHtp3n88boFq9Rsrb9PSebz1QB6SbORZvrbqjl/:isDAs988gaCb951QocORZ32l/

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      $77XD.exe

    • Size

      41KB

    • MD5

      2ae06f9b3b5a3f18090ab9e94c9a634f

    • SHA1

      9a99637ddd19922f735532dcedce205a3f0502e3

    • SHA256

      197031b846e5375fbc859df86bc2746e0583dce86d261c23cab72693b820473e

    • SHA512

      45ed777202c6b907e79c79bd877add0d36db2854e29692ab346c4f2822b8453c0afd8aa1c655adc268b71204916db71e4cbebbfbc724dde255d950b43f9feb05

    • SSDEEP

      768:is7PAsxblBHtp3n88boFq9Rsrb9PSebz1QB6SbORZvrbqjl/:isDAs988gaCb951QocORZ32l/

    Score
    8/10
    evasionpersistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks