Overview

overview

10

Static

static

10

2b169fa7dc...cN.exe

windows7-x64

8

2b169fa7dc...cN.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b169fa7dc7ee335fe78c8f00ff0d104e49efb178e71137dfe66d9e0666b739cN

  • Size

    48KB

  • Sample

    240919-ef2nyazeln

  • MD5

    545e6e913780d3a3ee836ba9e25ec610

  • SHA1

    a22a32f6a95e1a8e4313f4498c9a4be48330639c

  • SHA256

    2b169fa7dc7ee335fe78c8f00ff0d104e49efb178e71137dfe66d9e0666b739c

  • SHA512

    a1ad390566d7f2d2e5d5894e34bc7f250984140ee8298dde49e1a42e6ca7cd68363909b76a43b2a1a330ff470e3ca63f7a201d95fe2afc34e9725035039745d7

  • SSDEEP

    768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ohPC:Ub1MsHz3JDwhyWr+N95OTga67

Score
10/10
runningratdiscoverypersistence

Malware Config

Targets

    • Target

      2b169fa7dc7ee335fe78c8f00ff0d104e49efb178e71137dfe66d9e0666b739cN

    • Size

      48KB

    • MD5

      545e6e913780d3a3ee836ba9e25ec610

    • SHA1

      a22a32f6a95e1a8e4313f4498c9a4be48330639c

    • SHA256

      2b169fa7dc7ee335fe78c8f00ff0d104e49efb178e71137dfe66d9e0666b739c

    • SHA512

      a1ad390566d7f2d2e5d5894e34bc7f250984140ee8298dde49e1a42e6ca7cd68363909b76a43b2a1a330ff470e3ca63f7a201d95fe2afc34e9725035039745d7

    • SSDEEP

      768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ohPC:Ub1MsHz3JDwhyWr+N95OTga67

    Score
    8/10
    discoverypersistence

    • Server Software Component: Terminal Services DLL

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a Windows Service

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks