Overview

overview

8

Static

static

d9e1e30d76...31.exe

windows7_x64

8

d9e1e30d76...31.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9e1e30d76902c2c39aae8d5bcf66a019ca87586977f9af9dd8e8a8592f15a31

  • Size

    1.9MB

  • Sample

    210504-adybmfwevn

  • MD5

    92acd69a68727592ca0dae855f9d424e

  • SHA1

    5bccc8dce1845938b9a07abc933caa016522983f

  • SHA256

    d9e1e30d76902c2c39aae8d5bcf66a019ca87586977f9af9dd8e8a8592f15a31

  • SHA512

    c0493797878554fb32fe11be620d17c368daad52cdeb4c28c9e9bd90656fa78b47b155807fa12b97ccac8ffdc9c2c83c925c67d6339262c7c0057c2335fa69cb

Score
8/10
macropersistenceupx

Malware Config

Targets

    • Target

      d9e1e30d76902c2c39aae8d5bcf66a019ca87586977f9af9dd8e8a8592f15a31

    • Size

      1.9MB

    • MD5

      92acd69a68727592ca0dae855f9d424e

    • SHA1

      5bccc8dce1845938b9a07abc933caa016522983f

    • SHA256

      d9e1e30d76902c2c39aae8d5bcf66a019ca87586977f9af9dd8e8a8592f15a31

    • SHA512

      c0493797878554fb32fe11be620d17c368daad52cdeb4c28c9e9bd90656fa78b47b155807fa12b97ccac8ffdc9c2c83c925c67d6339262c7c0057c2335fa69cb

    Score
    8/10
    macropersistenceupx

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks