Overview

overview

8

Static

static

3

c8420dc616...0N.exe

windows7-x64

8

c8420dc616...0N.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    c8420dc616a0e7b7966303fa2cce3dc0N.exe

  • Size

    164KB

  • Sample

    240903-qy6w6ayamm

  • MD5

    c8420dc616a0e7b7966303fa2cce3dc0

  • SHA1

    1455345f2e7d340f3e69a3efed371278e3662389

  • SHA256

    181d7615af131fae7072e791cb1694ef1c1a62d735e80017406f1c7dc4f14303

  • SHA512

    7376cd6f5de1e25659433fa4dd4cd52a7434c4dbad695ed43e86e8ea00a861e98778d1fbbf1b09c2e575abb4b209015ddc182eab1c8f0928ddea957d007367ef

  • SSDEEP

    3072:1qpMJFLXBpNum6V0P60/KV69R1Vu8ljAE+cQqCdXe8hTJz:1qGvN4V0Pt9R1Vu8l0B9e8hT1

Score
8/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      c8420dc616a0e7b7966303fa2cce3dc0N.exe

    • Size

      164KB

    • MD5

      c8420dc616a0e7b7966303fa2cce3dc0

    • SHA1

      1455345f2e7d340f3e69a3efed371278e3662389

    • SHA256

      181d7615af131fae7072e791cb1694ef1c1a62d735e80017406f1c7dc4f14303

    • SHA512

      7376cd6f5de1e25659433fa4dd4cd52a7434c4dbad695ed43e86e8ea00a861e98778d1fbbf1b09c2e575abb4b209015ddc182eab1c8f0928ddea957d007367ef

    • SSDEEP

      3072:1qpMJFLXBpNum6V0P60/KV69R1Vu8ljAE+cQqCdXe8hTJz:1qGvN4V0Pt9R1Vu8l0B9e8hT1

    Score
    8/10
    defense_evasiondiscoveryevasionpersistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks