Overview

overview

10

Static

static

2d3c270b54...2d.exe

windows7-x64

10

2d3c270b54...2d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2d3c270b5492dc212fe52fed1a651359f62227dada021596a3c76191662c262d

  • Size

    508KB

  • Sample

    220919-xvlkdadef6

  • MD5

    b299587c13c6b38cfa8ba886d99fcf3a

  • SHA1

    646bc9286580d47e355f760d78c049b421d2d06a

  • SHA256

    2d3c270b5492dc212fe52fed1a651359f62227dada021596a3c76191662c262d

  • SHA512

    08556ada3f626e8d19012679edf565a769a0317198eae36787546c15dc68c7477db87f7b03036b2692033d8319b48f8a6dd3e70fa37127cd36c21bc9a0c12aca

  • SSDEEP

    6144:23xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:23xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      2d3c270b5492dc212fe52fed1a651359f62227dada021596a3c76191662c262d

    • Size

      508KB

    • MD5

      b299587c13c6b38cfa8ba886d99fcf3a

    • SHA1

      646bc9286580d47e355f760d78c049b421d2d06a

    • SHA256

      2d3c270b5492dc212fe52fed1a651359f62227dada021596a3c76191662c262d

    • SHA512

      08556ada3f626e8d19012679edf565a769a0317198eae36787546c15dc68c7477db87f7b03036b2692033d8319b48f8a6dd3e70fa37127cd36c21bc9a0c12aca

    • SSDEEP

      6144:23xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:23xxPuFVtSdWJsuWXLGMvxsltRok/Gy

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks