Overview

overview

8

Static

static

5bc5565c00...ee.exe

windows7_x64

8

5bc5565c00...ee.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5bc5565c00621538e2c6fb30c5699a0cdbd53852595bf894887852568166b8ee

  • Size

    882KB

  • Sample

    210511-wlj1da8th6

  • MD5

    ca27ec673fd1634332cdc0cd584590ae

  • SHA1

    bd77e8cdfb4a010bed9525819a40573ba0914bf8

  • SHA256

    5bc5565c00621538e2c6fb30c5699a0cdbd53852595bf894887852568166b8ee

  • SHA512

    f62da8a77e1adf9c775d518b03eb20b260e43a8a577ec0cafa39db8713f2d0703cfde702e61518631cf8391a0d9e8fd6834419b7d4e2b9309ac72d09e52993d8

Score
8/10
macropersistence

Malware Config

Targets

    • Target

      5bc5565c00621538e2c6fb30c5699a0cdbd53852595bf894887852568166b8ee

    • Size

      882KB

    • MD5

      ca27ec673fd1634332cdc0cd584590ae

    • SHA1

      bd77e8cdfb4a010bed9525819a40573ba0914bf8

    • SHA256

      5bc5565c00621538e2c6fb30c5699a0cdbd53852595bf894887852568166b8ee

    • SHA512

      f62da8a77e1adf9c775d518b03eb20b260e43a8a577ec0cafa39db8713f2d0703cfde702e61518631cf8391a0d9e8fd6834419b7d4e2b9309ac72d09e52993d8

    Score
    8/10
    macropersistence

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks