Overview

overview

8

Static

static

d58d380a60...fe.exe

windows7_x64

8

d58d380a60...fe.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d58d380a608624df1562d0e8ebb3372120c0e6f5e98bae496134e122374165fe

  • Size

    753KB

  • Sample

    210504-t8e46enm5x

  • MD5

    4cf49db56145ec0cb785a93a8a6369fd

  • SHA1

    9f679f75136e9f19075723351d016bfdb0df8bed

  • SHA256

    d58d380a608624df1562d0e8ebb3372120c0e6f5e98bae496134e122374165fe

  • SHA512

    90e6c263d76b233b5838b205b4c877516da34f0f62e250f91a99ebe419b237bcb2527524e0bef652ad789099160587c5f24d5ce1db2727fc56aae88d860e94ad

Score
8/10
macropersistence

Malware Config

Targets

    • Target

      d58d380a608624df1562d0e8ebb3372120c0e6f5e98bae496134e122374165fe

    • Size

      753KB

    • MD5

      4cf49db56145ec0cb785a93a8a6369fd

    • SHA1

      9f679f75136e9f19075723351d016bfdb0df8bed

    • SHA256

      d58d380a608624df1562d0e8ebb3372120c0e6f5e98bae496134e122374165fe

    • SHA512

      90e6c263d76b233b5838b205b4c877516da34f0f62e250f91a99ebe419b237bcb2527524e0bef652ad789099160587c5f24d5ce1db2727fc56aae88d860e94ad

    Score
    8/10
    persistencemacro

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks