Overview

overview

10

Static

static

c184be5fad...e7.exe

windows7-x64

10

c184be5fad...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c184be5fadecf5781544bff1f03c616c1b3eca14e5478e5887320c2543ee4fe7

  • Size

    544KB

  • Sample

    221003-de3zyaefdp

  • MD5

    444781db6d7e859a8553c64b6bbbf778

  • SHA1

    5f49954cd1fc4dec5b4a511911dd698b7c975535

  • SHA256

    c184be5fadecf5781544bff1f03c616c1b3eca14e5478e5887320c2543ee4fe7

  • SHA512

    dc0ea9b8294baf242d6b5042824964057de417e0b513c7e6efcb591eb7d923d37421d53d46b3c2d8d7b66a0d5d8d0945113a8e0ae3e14f6add00f428f9476862

  • SSDEEP

    12288:FQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:FQI+cJHiJRTHnxhUqEhe9suB2C8O9O

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      c184be5fadecf5781544bff1f03c616c1b3eca14e5478e5887320c2543ee4fe7

    • Size

      544KB

    • MD5

      444781db6d7e859a8553c64b6bbbf778

    • SHA1

      5f49954cd1fc4dec5b4a511911dd698b7c975535

    • SHA256

      c184be5fadecf5781544bff1f03c616c1b3eca14e5478e5887320c2543ee4fe7

    • SHA512

      dc0ea9b8294baf242d6b5042824964057de417e0b513c7e6efcb591eb7d923d37421d53d46b3c2d8d7b66a0d5d8d0945113a8e0ae3e14f6add00f428f9476862

    • SSDEEP

      12288:FQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:FQI+cJHiJRTHnxhUqEhe9suB2C8O9O

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks