Overview

overview

10

Static

static

1

b2b8f9cfc3...a6.exe

windows7-x64

10

b2b8f9cfc3...a6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b2b8f9cfc35ddcf9180a37b0f970f9b44028be63668bd34dc79628efb1a34aa6

  • Size

    2.0MB

  • Sample

    240803-b8spystdpf

  • MD5

    bd01532a83cc3ae8a8c18f2e3f361cbd

  • SHA1

    4c37ea91e3334cf42e79461b6370d5a3f56aa27a

  • SHA256

    b2b8f9cfc35ddcf9180a37b0f970f9b44028be63668bd34dc79628efb1a34aa6

  • SHA512

    f31f13fb3c013b3dc99fd750c19477ddd37eb59c8d7fed38af1dd71420fecef37a87ae9a5170badbe29925e9171a1ec4612f24194a1f06f5c37d0b1575960fd5

  • SSDEEP

    24576:4TbBv5rU0LmrMTlAtE4TuUmlBL32/g9FHS39QtMlTnVbWMpJJyx76BIAnTtY6TPz:6Bc2j68GuolzVbWMTPBIMZPDKR7jK

Score
10/10
discoveryevasionexecution

Malware Config

Targets

    • Target

      b2b8f9cfc35ddcf9180a37b0f970f9b44028be63668bd34dc79628efb1a34aa6

    • Size

      2.0MB

    • MD5

      bd01532a83cc3ae8a8c18f2e3f361cbd

    • SHA1

      4c37ea91e3334cf42e79461b6370d5a3f56aa27a

    • SHA256

      b2b8f9cfc35ddcf9180a37b0f970f9b44028be63668bd34dc79628efb1a34aa6

    • SHA512

      f31f13fb3c013b3dc99fd750c19477ddd37eb59c8d7fed38af1dd71420fecef37a87ae9a5170badbe29925e9171a1ec4612f24194a1f06f5c37d0b1575960fd5

    • SSDEEP

      24576:4TbBv5rU0LmrMTlAtE4TuUmlBL32/g9FHS39QtMlTnVbWMpJJyx76BIAnTtY6TPz:6Bc2j68GuolzVbWMTPBIMZPDKR7jK

    Score
    10/10
    discoveryevasionexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks