Overview

overview

10

Static

static

433526c997...ab.exe

windows7-x64

10

433526c997...ab.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab

  • Size

    504KB

  • Sample

    221128-chbjesbf9v

  • MD5

    06423b915fdde4d9a7051480a337123b

  • SHA1

    5ed71ff1c8432aab2e17887fd6eb9455b924dada

  • SHA256

    433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab

  • SHA512

    c3da80348d6a36a3255ff7ad24d0b840db8f34821558f4c983f5a924dd6ec2aa1ba4e54fc83659eba4698ba17f35e703a798d56eb21a88cb6a1d0b5e6b0fc447

  • SSDEEP

    12288:6OwQmZiqb/i5t+V9iTCSvEMseLPcRnKb:6OdeIe9ih8Ms+PU

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab

    • Size

      504KB

    • MD5

      06423b915fdde4d9a7051480a337123b

    • SHA1

      5ed71ff1c8432aab2e17887fd6eb9455b924dada

    • SHA256

      433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab

    • SHA512

      c3da80348d6a36a3255ff7ad24d0b840db8f34821558f4c983f5a924dd6ec2aa1ba4e54fc83659eba4698ba17f35e703a798d56eb21a88cb6a1d0b5e6b0fc447

    • SSDEEP

      12288:6OwQmZiqb/i5t+V9iTCSvEMseLPcRnKb:6OdeIe9ih8Ms+PU

    Score
    10/10
    evasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks