Overview

overview

8

Static

static

3e6a8e6709...d1.exe

windows7-x64

8

3e6a8e6709...d1.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e6a8e670992d9b688acc11e592a680be09b90e76fe1f35b4fae9f1a890fccd1

  • Size

    1.1MB

  • Sample

    221124-f6tlpabh77

  • MD5

    f04dbe32033708ece2d788c6bb7247df

  • SHA1

    0bee01d2f17f8b40947f5bec0c8ac364836e8359

  • SHA256

    3e6a8e670992d9b688acc11e592a680be09b90e76fe1f35b4fae9f1a890fccd1

  • SHA512

    f6218bb00630ce91fc8b25fd17f8029078344735895175f6e603d0273326b67e4ea68a22a103faf8c078d92b14e8cc9ed72dfa24f17734c6fe5901727b2a95ba

  • SSDEEP

    24576:FIF6nnjqKoeM+lgkRW6RXjnV6HJfzag4DiD8csEwq:FIojqKoeM+lxjnON4DiDhwq

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      3e6a8e670992d9b688acc11e592a680be09b90e76fe1f35b4fae9f1a890fccd1

    • Size

      1.1MB

    • MD5

      f04dbe32033708ece2d788c6bb7247df

    • SHA1

      0bee01d2f17f8b40947f5bec0c8ac364836e8359

    • SHA256

      3e6a8e670992d9b688acc11e592a680be09b90e76fe1f35b4fae9f1a890fccd1

    • SHA512

      f6218bb00630ce91fc8b25fd17f8029078344735895175f6e603d0273326b67e4ea68a22a103faf8c078d92b14e8cc9ed72dfa24f17734c6fe5901727b2a95ba

    • SSDEEP

      24576:FIF6nnjqKoeM+lgkRW6RXjnV6HJfzag4DiD8csEwq:FIojqKoeM+lxjnON4DiDhwq

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks