Overview

overview

10

Static

static

10

17da3c794c...a0.exe

windows7-x64

7

17da3c794c...a0.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17da3c794c6c82585652360272c9ba924ad892d7d2243aa9f84167646e8427a0

  • Size

    24.2MB

  • Sample

    250129-bmabgswnh1

  • MD5

    4d3e57d1bf494b6894ff054a51cb76ed

  • SHA1

    1fdd5efc9f34c24e821145817d81d19505847fc2

  • SHA256

    17da3c794c6c82585652360272c9ba924ad892d7d2243aa9f84167646e8427a0

  • SHA512

    8b4a3acf80677717d2af59335e8729fc6463cab55364772c9f04023b75f21dc0f14519d9e4b344eea1d87d6ac9baeff1bd6bcade8784769424214e61ef298403

  • SSDEEP

    196608:Gk8oRvgMb5vryItxNGR4ekyCHGif40aSa/2RoRs/QGy5EkU/uiVrXJ:G46Mb5vrfwR4eQSooRs/QOkUjzJ

Score
10/10
blackguardpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      17da3c794c6c82585652360272c9ba924ad892d7d2243aa9f84167646e8427a0

    • Size

      24.2MB

    • MD5

      4d3e57d1bf494b6894ff054a51cb76ed

    • SHA1

      1fdd5efc9f34c24e821145817d81d19505847fc2

    • SHA256

      17da3c794c6c82585652360272c9ba924ad892d7d2243aa9f84167646e8427a0

    • SHA512

      8b4a3acf80677717d2af59335e8729fc6463cab55364772c9f04023b75f21dc0f14519d9e4b344eea1d87d6ac9baeff1bd6bcade8784769424214e61ef298403

    • SSDEEP

      196608:Gk8oRvgMb5vryItxNGR4ekyCHGif40aSa/2RoRs/QGy5EkU/uiVrXJ:G46Mb5vrfwR4eQSooRs/QOkUjzJ

    Score
    7/10
    persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks