Overview

overview

10

Static

static

d8b90e89d5...25.exe

windows7-x64

10

d8b90e89d5...25.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8b90e89d54ec84226505f318b41f68ae4a09ee276b1ddc1604c051c16155d25

  • Size

    508KB

  • Sample

    221106-rd4fzagfhq

  • MD5

    0d7d510f7afd78b0296655fddacf8ec5

  • SHA1

    2ea03d8143661a28180e479ca6e2e02869d0967e

  • SHA256

    d8b90e89d54ec84226505f318b41f68ae4a09ee276b1ddc1604c051c16155d25

  • SHA512

    ff4e50c4d7ef127167561e39251bcec36248b4dae4cb695dff18e6a1c58b8bfa948e5182f89766612d6f3448a8ae6408f918e42d859d0fd5e081590e3d3751fc

  • SSDEEP

    6144:T3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:T3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      d8b90e89d54ec84226505f318b41f68ae4a09ee276b1ddc1604c051c16155d25

    • Size

      508KB

    • MD5

      0d7d510f7afd78b0296655fddacf8ec5

    • SHA1

      2ea03d8143661a28180e479ca6e2e02869d0967e

    • SHA256

      d8b90e89d54ec84226505f318b41f68ae4a09ee276b1ddc1604c051c16155d25

    • SHA512

      ff4e50c4d7ef127167561e39251bcec36248b4dae4cb695dff18e6a1c58b8bfa948e5182f89766612d6f3448a8ae6408f918e42d859d0fd5e081590e3d3751fc

    • SSDEEP

      6144:T3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:T3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks