Overview

overview

8

Static

static

e52ef39ac5...89.exe

windows7-x64

8

e52ef39ac5...89.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e52ef39ac5ac6160e7eadf26f9e417908a431075afe53650462fa0f8e79d3f89

  • Size

    411KB

  • Sample

    221126-21c8eafb2w

  • MD5

    4b40b9ef59cc43e31c409e5ac11ea084

  • SHA1

    5698567ef01390161a86dbb8e5bbd6ab2b1e0de4

  • SHA256

    e52ef39ac5ac6160e7eadf26f9e417908a431075afe53650462fa0f8e79d3f89

  • SHA512

    237aafdbc59e98019f6d677f79dc7f6538832cc1ebb0eb9f9d9d1d44ea35727445fb84d0574e83cd89e9b0df1f2b73bb8885dcd9bcddd87f79d09130b402b18e

  • SSDEEP

    12288:me3VUk7qBP038DEz85I07TmF6FaKTQRMjrd:m0Uk7T6hb0Rg

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      e52ef39ac5ac6160e7eadf26f9e417908a431075afe53650462fa0f8e79d3f89

    • Size

      411KB

    • MD5

      4b40b9ef59cc43e31c409e5ac11ea084

    • SHA1

      5698567ef01390161a86dbb8e5bbd6ab2b1e0de4

    • SHA256

      e52ef39ac5ac6160e7eadf26f9e417908a431075afe53650462fa0f8e79d3f89

    • SHA512

      237aafdbc59e98019f6d677f79dc7f6538832cc1ebb0eb9f9d9d1d44ea35727445fb84d0574e83cd89e9b0df1f2b73bb8885dcd9bcddd87f79d09130b402b18e

    • SSDEEP

      12288:me3VUk7qBP038DEz85I07TmF6FaKTQRMjrd:m0Uk7T6hb0Rg

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks