General
- Target 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3
- Size 5.6MB
- Sample261017-m1cvbassez
- SHA256 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3
Score
8/10
Malware Config
Targets
-
- Target 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3
- Size 5.6MB
- SHA256 6b68ed9377d59bb2aabc9d680b9f08806e31821073d144855ae44b1251c784f3
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
DCAgent remote management tool
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2