Overview

overview

8

Static

static

3ce041073b...ba.exe

windows7-x64

8

3ce041073b...ba.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ce041073b7039a21f24c636ff96c27ad9dc37bc223498ebb5760950092710ba

  • Size

    55KB

  • Sample

    221030-qfepysbhh9

  • MD5

    a30b1e99f9524ae94414dfacfaba91b0

  • SHA1

    30311d9a3eee332459dbcb37b905b295a4fc84eb

  • SHA256

    3ce041073b7039a21f24c636ff96c27ad9dc37bc223498ebb5760950092710ba

  • SHA512

    b87e8653a27981d9715b6909427a67aa604d6c2c15115358685d192b4adcea0b665206328a0e9fb6d49b8a34718fd49f84a7e85a3a331c07bc6b4a90f8dbd8af

  • SSDEEP

    768:wVqibuG53iD7IEsDOMnop8Lju5K4SN2XPkn9d85o/:wVqif5yvCD2fkn9ky

Score
8/10

Malware Config

Targets

    • Target

      3ce041073b7039a21f24c636ff96c27ad9dc37bc223498ebb5760950092710ba

    • Size

      55KB

    • MD5

      a30b1e99f9524ae94414dfacfaba91b0

    • SHA1

      30311d9a3eee332459dbcb37b905b295a4fc84eb

    • SHA256

      3ce041073b7039a21f24c636ff96c27ad9dc37bc223498ebb5760950092710ba

    • SHA512

      b87e8653a27981d9715b6909427a67aa604d6c2c15115358685d192b4adcea0b665206328a0e9fb6d49b8a34718fd49f84a7e85a3a331c07bc6b4a90f8dbd8af

    • SSDEEP

      768:wVqibuG53iD7IEsDOMnop8Lju5K4SN2XPkn9d85o/:wVqif5yvCD2fkn9ky

    Score
    8/10

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Uses the VBS compiler for execution

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks