Overview

overview

10

Static

static

d0490c1906...7d.exe

windows7-x64

10

d0490c1906...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0490c19063df57822ec00ce994a77655915ad6557f58b527a00b09b25cd087d

  • Size

    112KB

  • Sample

    221020-fyqvtsfecn

  • MD5

    80e46ccbe453f59ff50e37ddfd94112d

  • SHA1

    c26e8ba3b8d9a488a837bbdb85805f3f1e8fbbb1

  • SHA256

    d0490c19063df57822ec00ce994a77655915ad6557f58b527a00b09b25cd087d

  • SHA512

    3b2213498d670d56642dcffc5d3142bb1f5492d7118ac9375f955054c4e2fb0e8e4664e0dc3f46d43a6b935e756a75717937c8281cecac26c0a74f8cda2df06d

  • SSDEEP

    768:MYE3pGnDiOd+/uJd/iCVMx6/Pbjh7uWHC2ZPFPPC44444444444444444444444w:zE3Y+/hZ0Fu29ZPFPE8Tno9yqRBljF

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      d0490c19063df57822ec00ce994a77655915ad6557f58b527a00b09b25cd087d

    • Size

      112KB

    • MD5

      80e46ccbe453f59ff50e37ddfd94112d

    • SHA1

      c26e8ba3b8d9a488a837bbdb85805f3f1e8fbbb1

    • SHA256

      d0490c19063df57822ec00ce994a77655915ad6557f58b527a00b09b25cd087d

    • SHA512

      3b2213498d670d56642dcffc5d3142bb1f5492d7118ac9375f955054c4e2fb0e8e4664e0dc3f46d43a6b935e756a75717937c8281cecac26c0a74f8cda2df06d

    • SSDEEP

      768:MYE3pGnDiOd+/uJd/iCVMx6/Pbjh7uWHC2ZPFPPC44444444444444444444444w:zE3Y+/hZ0Fu29ZPFPE8Tno9yqRBljF

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks