Overview

overview

10

Static

static

3

1d81e25273...bN.exe

windows7-x64

10

1d81e25273...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72abN

  • Size

    184KB

  • Sample

    240920-g9kzdsshka

  • MD5

    7c1c59164694d079dde9e840a5f68df0

  • SHA1

    f39cd3e73a80e750817a27964e8a50a1056c3424

  • SHA256

    1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72ab

  • SHA512

    120fd2a88d34a5148581de50d939440bbc7ac11937364737a4b8fc9e52a5aaba75bbc2ce54d08ab77b23aabcea168dc2d89ee7d114942b39e22db8d2ff5ff17c

  • SSDEEP

    3072:bX1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RFsUZSY:pClpTFzKnvmb7/D26y4qMSyKbOD2r1oi

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72abN

    • Size

      184KB

    • MD5

      7c1c59164694d079dde9e840a5f68df0

    • SHA1

      f39cd3e73a80e750817a27964e8a50a1056c3424

    • SHA256

      1d81e252736276a92b491baf5b7c81c6980f2934a73f2540df63d8df102b72ab

    • SHA512

      120fd2a88d34a5148581de50d939440bbc7ac11937364737a4b8fc9e52a5aaba75bbc2ce54d08ab77b23aabcea168dc2d89ee7d114942b39e22db8d2ff5ff17c

    • SSDEEP

      3072:bX1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RFsUZSY:pClpTFzKnvmb7/D26y4qMSyKbOD2r1oi

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks