Overview

overview

8

Static

static

649b5f10ad...9c.exe

windows7_x64

8

649b5f10ad...9c.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    649b5f10ad75fb9c2853557a6c917a08bdaa093edc50336e2e67567c2f18209c

  • Size

    1.1MB

  • Sample

    210511-356fjs87c2

  • MD5

    0cb8969338e3cd25d6341680adcdc171

  • SHA1

    f09f024f6a05502d33311fda881bcb91dbda0640

  • SHA256

    649b5f10ad75fb9c2853557a6c917a08bdaa093edc50336e2e67567c2f18209c

  • SHA512

    a4f89ab776e76e0947beccb1c388a57a90b8f4e338d20c84809e74586b2b614e1a626c5261b74f4a8701b89a5ca560ed5d8fe51a15af4f4adfc88f6b84a0cbec

Score
8/10
macropersistence

Malware Config

Targets

    • Target

      649b5f10ad75fb9c2853557a6c917a08bdaa093edc50336e2e67567c2f18209c

    • Size

      1.1MB

    • MD5

      0cb8969338e3cd25d6341680adcdc171

    • SHA1

      f09f024f6a05502d33311fda881bcb91dbda0640

    • SHA256

      649b5f10ad75fb9c2853557a6c917a08bdaa093edc50336e2e67567c2f18209c

    • SHA512

      a4f89ab776e76e0947beccb1c388a57a90b8f4e338d20c84809e74586b2b614e1a626c5261b74f4a8701b89a5ca560ed5d8fe51a15af4f4adfc88f6b84a0cbec

    Score
    8/10
    macropersistence

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks