Overview

overview

10

Static

static

3

9d8133b213...81.exe

windows7-x64

10

9d8133b213...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81

  • Size

    2.1MB

  • Sample

    241013-bgbmcs1dnd

  • MD5

    8e3c20227c45fb59c9a595c3a78448de

  • SHA1

    85b16583812a18d1d718222bd423dc0dd92eaddb

  • SHA256

    9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81

  • SHA512

    30fdcf629c43cc0ed2118a3d4ddb591d803b93e2b54c3451b7f046d662315dd5a0916ec4a22068d423a977e6847b697a8f597b749f7a505dda3b660486f7c9e1

  • SSDEEP

    49152:g727d7A7yD7q7yD72747q7yD7A7yD7q7yDD:g65MmD2mD6c2mDMmD2mDD

Score
10/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81

    • Size

      2.1MB

    • MD5

      8e3c20227c45fb59c9a595c3a78448de

    • SHA1

      85b16583812a18d1d718222bd423dc0dd92eaddb

    • SHA256

      9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81

    • SHA512

      30fdcf629c43cc0ed2118a3d4ddb591d803b93e2b54c3451b7f046d662315dd5a0916ec4a22068d423a977e6847b697a8f597b749f7a505dda3b660486f7c9e1

    • SSDEEP

      49152:g727d7A7yD7q7yD72747q7yD7A7yD7q7yDD:g65MmD2mD6c2mDMmD2mDD

    Score
    10/10
    defense_evasiondiscoveryevasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks