Overview

overview

10

Static

static

acddb1bd00...66.exe

windows7-x64

1

acddb1bd00...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acddb1bd00c82aa878db043c8425197ae2697fd3311425ff5c833c96c2c6bb66

  • Size

    131KB

  • Sample

    221201-r8rewsdb8t

  • MD5

    3ee6ca942a35fde4cbd4cc90c69b494f

  • SHA1

    d2556116cebc77734995571b4793a5bf1df8a3c1

  • SHA256

    acddb1bd00c82aa878db043c8425197ae2697fd3311425ff5c833c96c2c6bb66

  • SHA512

    8f5f4ec157b38e31b978c6db67aae7768c52dae42b28563f6463a22d2ff287d96b6071c36c236bb37df4fb273b1c0fef2abe61773dc3e3d37198755c06645668

  • SSDEEP

    3072:U6Ooaa75Sgk3EUJhwLo/ec7hdnqE6Y5KOFcnxStrWc:vak0Jqwecvnh62gQ

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      acddb1bd00c82aa878db043c8425197ae2697fd3311425ff5c833c96c2c6bb66

    • Size

      131KB

    • MD5

      3ee6ca942a35fde4cbd4cc90c69b494f

    • SHA1

      d2556116cebc77734995571b4793a5bf1df8a3c1

    • SHA256

      acddb1bd00c82aa878db043c8425197ae2697fd3311425ff5c833c96c2c6bb66

    • SHA512

      8f5f4ec157b38e31b978c6db67aae7768c52dae42b28563f6463a22d2ff287d96b6071c36c236bb37df4fb273b1c0fef2abe61773dc3e3d37198755c06645668

    • SSDEEP

      3072:U6Ooaa75Sgk3EUJhwLo/ec7hdnqE6Y5KOFcnxStrWc:vak0Jqwecvnh62gQ

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks