Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    87KB

  • Sample

    221011-lmma6agdf5

  • MD5

    769df9e877f419beb20a34515a4b211f

  • SHA1

    8de6ec68b339a3f8761703b20a3cfe1c4370f532

  • SHA256

    d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489

  • SHA512

    ef19bd14aac3260be66a30ff21fedf181ece14fb67e76546fa41b6462f2514645c0c2cd0a6244be1b03af71459114c66f28bc588eabaab3d340071a80aa8d8ea

  • SSDEEP

    1536:VpQKRk5UqXbkb2bM5XiE6cuR0Zng71jahYQeEmus8jcd3WWn7q:r6rkb2b6S3cuREn0ahZeEmr3WWn7q

Score
10/10

Malware Config

Targets

    • Target

      file.exe

    • Size

      87KB

    • MD5

      769df9e877f419beb20a34515a4b211f

    • SHA1

      8de6ec68b339a3f8761703b20a3cfe1c4370f532

    • SHA256

      d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489

    • SHA512

      ef19bd14aac3260be66a30ff21fedf181ece14fb67e76546fa41b6462f2514645c0c2cd0a6244be1b03af71459114c66f28bc588eabaab3d340071a80aa8d8ea

    • SSDEEP

      1536:VpQKRk5UqXbkb2bM5XiE6cuR0Zng71jahYQeEmus8jcd3WWn7q:r6rkb2b6S3cuREn0ahZeEmr3WWn7q

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks