Overview

overview

10

Static

static

3

09939d42b8...18.exe

windows7-x64

10

09939d42b8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09939d42b84f8c7397c6e0d8c082c0a56e6265db9455eacce7680c6250721f18

  • Size

    712KB

  • Sample

    240611-w4xhkawgma

  • MD5

    1b8121aed2dbdeaf0e3de530194dc8c9

  • SHA1

    88b16ba3b6bc1d1d1253bd4ca16c542bbeea1edc

  • SHA256

    09939d42b84f8c7397c6e0d8c082c0a56e6265db9455eacce7680c6250721f18

  • SHA512

    701d9bbb8b9678e5ba5eb644f197e6a1e44c2c94b55fbc580888b5e7f13a79a9ad60596de285e7a2ae2548a6622ccc67e7ea02783b32837531a6f5d41ff37eec

  • SSDEEP

    6144:e1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqCQFHgTWGHp86JQPDHDdx/Qtqa:rOkiCpat4FU6JXKqFZg1JPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      09939d42b84f8c7397c6e0d8c082c0a56e6265db9455eacce7680c6250721f18

    • Size

      712KB

    • MD5

      1b8121aed2dbdeaf0e3de530194dc8c9

    • SHA1

      88b16ba3b6bc1d1d1253bd4ca16c542bbeea1edc

    • SHA256

      09939d42b84f8c7397c6e0d8c082c0a56e6265db9455eacce7680c6250721f18

    • SHA512

      701d9bbb8b9678e5ba5eb644f197e6a1e44c2c94b55fbc580888b5e7f13a79a9ad60596de285e7a2ae2548a6622ccc67e7ea02783b32837531a6f5d41ff37eec

    • SSDEEP

      6144:e1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqCQFHgTWGHp86JQPDHDdx/Qtqa:rOkiCpat4FU6JXKqFZg1JPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks