Overview

overview

8

Static

static

3

loader.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader.exe

  • Size

    11.2MB

  • Sample

    250102-vyn4kayrhw

  • MD5

    dc381e4742d038d5f58967d3cf95658d

  • SHA1

    f55f685697d0f3c6c3ed84891ce52bd25b9fb186

  • SHA256

    097eceaf81d57db8f872ca516f1d1135b1624db2b0d429bae14d29ce7872542e

  • SHA512

    d031f6b4473a15493c3a87c77d3919c763775320013c3680075dd039cde3f8859c619aff68b310e7f80a79b5c3a7648e2254f126481860fad81cf7e03ec74216

  • SSDEEP

    196608:msyb9vh832DXcB+nMi7EClIHZd+71zmUAY+5rzGn+Oo21CCs6su5H:Ly9vPXcEnZ7EnZu1HinwFrz5

Score
8/10
microsoftdiscoverypersistencephishingprivilege_escalation

Malware Config

Targets

    • Target

      loader.exe

    • Size

      11.2MB

    • MD5

      dc381e4742d038d5f58967d3cf95658d

    • SHA1

      f55f685697d0f3c6c3ed84891ce52bd25b9fb186

    • SHA256

      097eceaf81d57db8f872ca516f1d1135b1624db2b0d429bae14d29ce7872542e

    • SHA512

      d031f6b4473a15493c3a87c77d3919c763775320013c3680075dd039cde3f8859c619aff68b310e7f80a79b5c3a7648e2254f126481860fad81cf7e03ec74216

    • SSDEEP

      196608:msyb9vh832DXcB+nMi7EClIHZd+71zmUAY+5rzGn+Oo21CCs6su5H:Ly9vPXcEnZ7EnZu1HinwFrz5

    Score
    8/10
    microsoftdiscoverypersistencephishingprivilege_escalation

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand MICROSOFT.

      phishingmicrosoft

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks