General

  • Target

    fb49ccc6f2a133d6b1e955dc7b7775caf9108e22d9a561cb04d76c41c8b755b3

  • Size

    320KB

  • Sample

    241122-gqbxda1nhk

  • MD5

    740afbeaa06922e913a871f592541331

  • SHA1

    b0eaeb7152f55f42fa0126d9e2b2117ddfec1cff

  • SHA256

    fb49ccc6f2a133d6b1e955dc7b7775caf9108e22d9a561cb04d76c41c8b755b3

  • SHA512

    26657d4dba67ba090ca44fcc48cc71824fde5416dea856bc5c5a09a0a9c36c831e8daa335af2d6f46b1174f7cd8867ef3c664e0e121c94be368411db51a05881

  • SSDEEP

    6144:4TwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:WXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

Malware Config

Targets

    • Target

      fb49ccc6f2a133d6b1e955dc7b7775caf9108e22d9a561cb04d76c41c8b755b3

    • Size

      320KB

    • MD5

      740afbeaa06922e913a871f592541331

    • SHA1

      b0eaeb7152f55f42fa0126d9e2b2117ddfec1cff

    • SHA256

      fb49ccc6f2a133d6b1e955dc7b7775caf9108e22d9a561cb04d76c41c8b755b3

    • SHA512

      26657d4dba67ba090ca44fcc48cc71824fde5416dea856bc5c5a09a0a9c36c831e8daa335af2d6f46b1174f7cd8867ef3c664e0e121c94be368411db51a05881

    • SSDEEP

      6144:4TwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:WXgvmzFHi0mo5aH0qMzd5807FRPJQPDV

    • Modifies WinLogon for persistence

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks