General

  • Target

    Cortex.Command.Installer.exe

  • Size

    107.0MB

  • Sample

    240709-xkzn9a1enb

  • MD5

    ffbfd537f581450c0fbef4274eed5ad1

  • SHA1

    1379b1b30b9dad1ad9f499d32f6487cf06e82b73

  • SHA256

    f98d9022a796c324c8258577fc0bbee43c02a746be10e791eae1e42da1fc989b

  • SHA512

    582bda95dad7b0246ebc23a2744dcfd368fb4f7040d44feb44d6cf742dd5e49ebbe7b1d381b465158493e0f285ed8b5fa4496d0647a64b1ee8e447da8555212e

  • SSDEEP

    3145728:G+1bLx+WzEcHFE7tYT7pVnYXdqySLE9Hut9hY4aEoBd:GefVzEclgtO7p6NHWoO9FOd

Malware Config

Targets

    • Target

      Cortex.Command.Installer.exe

    • Size

      107.0MB

    • MD5

      ffbfd537f581450c0fbef4274eed5ad1

    • SHA1

      1379b1b30b9dad1ad9f499d32f6487cf06e82b73

    • SHA256

      f98d9022a796c324c8258577fc0bbee43c02a746be10e791eae1e42da1fc989b

    • SHA512

      582bda95dad7b0246ebc23a2744dcfd368fb4f7040d44feb44d6cf742dd5e49ebbe7b1d381b465158493e0f285ed8b5fa4496d0647a64b1ee8e447da8555212e

    • SSDEEP

      3145728:G+1bLx+WzEcHFE7tYT7pVnYXdqySLE9Hut9hY4aEoBd:GefVzEclgtO7p6NHWoO9FOd

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks