Overview

overview

8

Static

static

Install.exe

windows7_x64

8

Install.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Install.exe

  • Size

    4.5MB

  • Sample

    220327-as4a3sfdgn

  • MD5

    280bfd5ea1f41586ea0ef60ee44bc8db

  • SHA1

    57aa866f42bccbaceed938390001148323d033c1

  • SHA256

    a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9

  • SHA512

    5c2bd96fd1bf0d3c3cfbca97666c9b20a6ae2ee651ad50739d30a24339b90c9f5261c9c5ea93004c4d048d892708a22802f615f5ac8a7464dc07a614366e0bd8

Score
8/10

Malware Config

Targets

    • Target

      Install.exe

    • Size

      4.5MB

    • MD5

      280bfd5ea1f41586ea0ef60ee44bc8db

    • SHA1

      57aa866f42bccbaceed938390001148323d033c1

    • SHA256

      a6ca5523fce6a4a43964319c35ecb868186465309e9226ab07c158519a5ef6f9

    • SHA512

      5c2bd96fd1bf0d3c3cfbca97666c9b20a6ae2ee651ad50739d30a24339b90c9f5261c9c5ea93004c4d048d892708a22802f615f5ac8a7464dc07a614366e0bd8

    Score
    8/10

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks