cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20 | Triage

Submit
Reports

Overview

overview

Static

static

8

cd57dae9a5...20.exe

windows7-x64

cd57dae9a5...20.exe

windows10-2004-x64

Sharing

General

Target

cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20
Size

270KB
Sample

221003-1gsnbagehp
MD5

06ad9e5a069740a4abe6328beeb4e6f2
SHA1

664d96aededaa66ee7d1748b4f3155dbde4c4465
SHA256

cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20
SHA512

b2fef51c8eebfbd507803539c7c28145101e6f78b0980cf041bfc938d66dddb72d896cf233b95c273f0a22641a670558d5f16d2b09fa283864a10c8beb61479d
SSDEEP

6144:kWfCbohHv6mC21AAf3os6SC+vyJ65FrD1yyIchVjz5GEKQVfjixoSM:tfuopvBCSfYdN6yE55D1yyIcVPqQVfjh

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20
- Size
  
  270KB
- MD5
  
  06ad9e5a069740a4abe6328beeb4e6f2
- SHA1
  
  664d96aededaa66ee7d1748b4f3155dbde4c4465
- SHA256
  
  cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20
- SHA512
  
  b2fef51c8eebfbd507803539c7c28145101e6f78b0980cf041bfc938d66dddb72d896cf233b95c273f0a22641a670558d5f16d2b09fa283864a10c8beb61479d
- SSDEEP
  
  6144:kWfCbohHv6mC21AAf3os6SC+vyJ65FrD1yyIchVjz5GEKQVfjixoSM:tfuopvBCSfYdN6yE55D1yyIcVPqQVfjh
Score

10^/10

evasion persistence upx
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2024

Terms | Privacy