Overview

overview

8

Static

static

3

356f56cabc...61.exe

windows7-x64

8

356f56cabc...61.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe

  • Size

    2.7MB

  • Sample

    240901-nn6saszdle

  • MD5

    15fbc3057d25e308e0832ad1a7d62e26

  • SHA1

    c90180b2360b4f12a32630f007b3e560d06be558

  • SHA256

    356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61

  • SHA512

    9ce05267bfdfdaa8f20670b885530aac0c7a13cfe01f8b15b5624318f5948462b6cdd7bc523b3fda3ed06ddaacc81d85a99d36af4f6b711d396f03018204f14a

  • SSDEEP

    49152:g7XlYr35b3BZENDqOwwKUv9sZ76Sq+m0Zaupr7/EDXhFlD:4Xl839jEYOwPg+KsEbhP

Score
8/10
evasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe

    • Size

      2.7MB

    • MD5

      15fbc3057d25e308e0832ad1a7d62e26

    • SHA1

      c90180b2360b4f12a32630f007b3e560d06be558

    • SHA256

      356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61

    • SHA512

      9ce05267bfdfdaa8f20670b885530aac0c7a13cfe01f8b15b5624318f5948462b6cdd7bc523b3fda3ed06ddaacc81d85a99d36af4f6b711d396f03018204f14a

    • SSDEEP

      49152:g7XlYr35b3BZENDqOwwKUv9sZ76Sq+m0Zaupr7/EDXhFlD:4Xl839jEYOwPg+KsEbhP

    Score
    8/10
    evasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks