Overview

overview

8

Static

static

5b300dc0c3...d3.exe

windows7-x64

8

5b300dc0c3...d3.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b300dc0c32e532403bb837b0191eed3.exe

  • Size

    1.9MB

  • Sample

    221004-s77adsbdc5

  • MD5

    5b300dc0c32e532403bb837b0191eed3

  • SHA1

    4c43517b9cc87e2f77ea66565ccc632a38e1225f

  • SHA256

    d779b5de8ad366452553d0ebcd89df3a6ab477773dfa540db0a09f828ef25ca9

  • SHA512

    ee52571308db81c09a1df6f0a4caf0025e3d7c7788aff9cfd21d88250a1353fcccc827c4c91fd89881de2a24a22d29e7cad08dd510cb12cb2500212d8f4ef575

  • SSDEEP

    24576:E15J6FsxG/3/DAhWGupqf/4RCQrSQKXdUFUj33RUs3H:E15J6ex8PDb9G/vi7K2ijRUs

Score
8/10
persistence

Malware Config

Targets

    • Target

      5b300dc0c32e532403bb837b0191eed3.exe

    • Size

      1.9MB

    • MD5

      5b300dc0c32e532403bb837b0191eed3

    • SHA1

      4c43517b9cc87e2f77ea66565ccc632a38e1225f

    • SHA256

      d779b5de8ad366452553d0ebcd89df3a6ab477773dfa540db0a09f828ef25ca9

    • SHA512

      ee52571308db81c09a1df6f0a4caf0025e3d7c7788aff9cfd21d88250a1353fcccc827c4c91fd89881de2a24a22d29e7cad08dd510cb12cb2500212d8f4ef575

    • SSDEEP

      24576:E15J6FsxG/3/DAhWGupqf/4RCQrSQKXdUFUj33RUs3H:E15J6ex8PDb9G/vi7K2ijRUs

    Score
    8/10
    persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks