Overview

overview

8

Static

static

43e7556ee9...28.exe

windows7-x64

8

43e7556ee9...28.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43e7556ee96ff8d549add115296581400c3d094a775059c681f6d26bb92f0228

  • Size

    446KB

  • Sample

    221125-cpj45shb21

  • MD5

    4e28baedcf7b9edd910ca0a42507c5fe

  • SHA1

    a9b6408398bd699dc3e43989c38b6a364efd5d10

  • SHA256

    43e7556ee96ff8d549add115296581400c3d094a775059c681f6d26bb92f0228

  • SHA512

    2317601f17cf35e0a9c8e5103594a9cf8fad74501000e185c82f16973f66c26c3f986486f4ef619cd6eb6a5953fc06b6cce80d4d869f8301a1d359ebc179b757

  • SSDEEP

    6144:h/bILVvWfZc2yyniah522IA2NXZYDxpttGW8UY4Q9qCzVtyjXP56OS+IZ:h0xWfZc2caP22D28ltzetyjDPi

Score
8/10
persistence

Malware Config

Targets

    • Target

      43e7556ee96ff8d549add115296581400c3d094a775059c681f6d26bb92f0228

    • Size

      446KB

    • MD5

      4e28baedcf7b9edd910ca0a42507c5fe

    • SHA1

      a9b6408398bd699dc3e43989c38b6a364efd5d10

    • SHA256

      43e7556ee96ff8d549add115296581400c3d094a775059c681f6d26bb92f0228

    • SHA512

      2317601f17cf35e0a9c8e5103594a9cf8fad74501000e185c82f16973f66c26c3f986486f4ef619cd6eb6a5953fc06b6cce80d4d869f8301a1d359ebc179b757

    • SSDEEP

      6144:h/bILVvWfZc2yyniah522IA2NXZYDxpttGW8UY4Q9qCzVtyjXP56OS+IZ:h0xWfZc2caP22D28ltzetyjDPi

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks