Overview

overview

10

Static

static

491eee56d1...77.exe

windows7-x64

10

491eee56d1...77.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    491eee56d107f177e6d5dc77da26e5b0a3c0fa12db02ba0e8b369f115ea2da77

  • Size

    1.0MB

  • Sample

    221123-s8a9cadc65

  • MD5

    0f10c5c101c989bfd2953ab9c764f58d

  • SHA1

    cdc0c98b770980955acc33c2ffeca2eaa0a3e6ad

  • SHA256

    491eee56d107f177e6d5dc77da26e5b0a3c0fa12db02ba0e8b369f115ea2da77

  • SHA512

    13900f45a533d5d905f8316f71afd604668d89a4f0d584163c791a7132dbf73b7bb70401c6143810ee400cb094010468a2920d1fc9c137f6bd6ea9fb8d88582b

  • SSDEEP

    24576:WpGViRsX40jSwvySN6COXPv8JMqBHLwY:WwWsX40jfn6CL1rJ

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      491eee56d107f177e6d5dc77da26e5b0a3c0fa12db02ba0e8b369f115ea2da77

    • Size

      1.0MB

    • MD5

      0f10c5c101c989bfd2953ab9c764f58d

    • SHA1

      cdc0c98b770980955acc33c2ffeca2eaa0a3e6ad

    • SHA256

      491eee56d107f177e6d5dc77da26e5b0a3c0fa12db02ba0e8b369f115ea2da77

    • SHA512

      13900f45a533d5d905f8316f71afd604668d89a4f0d584163c791a7132dbf73b7bb70401c6143810ee400cb094010468a2920d1fc9c137f6bd6ea9fb8d88582b

    • SSDEEP

      24576:WpGViRsX40jSwvySN6COXPv8JMqBHLwY:WwWsX40jfn6CL1rJ

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks