Overview

overview

8

Static

static

a37f825529...ac.exe

windows7-x64

8

a37f825529...ac.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

  • Size

    404KB

  • Sample

    221020-cg1rxshge7

  • MD5

    49ab5274566c34cad4bcd405c5348486

  • SHA1

    448c4042a27dc42db26fe1e8f818fd7f5868875b

  • SHA256

    a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

  • SHA512

    d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

  • SSDEEP

    3072:P0E93VChT34Sc+tO6b4QksbOlw+GjpbLnpfSb:PR

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

    • Size

      404KB

    • MD5

      49ab5274566c34cad4bcd405c5348486

    • SHA1

      448c4042a27dc42db26fe1e8f818fd7f5868875b

    • SHA256

      a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

    • SHA512

      d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

    • SSDEEP

      3072:P0E93VChT34Sc+tO6b4QksbOlw+GjpbLnpfSb:PR

    Score
    8/10
    persistenceupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks