Overview

overview

8

Static

static

d075e6f5a5...0a.exe

windows7-x64

8

d075e6f5a5...0a.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d075e6f5a56bbf4f5111088e8ea92ced1b833287031fec3a9c9c30d2edadbb0a

  • Size

    1.1MB

  • Sample

    221201-vtlgwaeb8w

  • MD5

    5e1c2e6f9198085ba91feadb94f1b368

  • SHA1

    354423c09e50fd8cbafedd104dd90efd6a52b691

  • SHA256

    d075e6f5a56bbf4f5111088e8ea92ced1b833287031fec3a9c9c30d2edadbb0a

  • SHA512

    df7b712fe79f9d6b58b11515830a8e72891fd9db9cd51e9e1f53515be5d48382f45d39467150f2601a03891d176b4e5009c1fa276be4ef749799294d9e7008b7

  • SSDEEP

    12288:EX87M0uZr2qmQ4FkK88BibQmGC5cYibZUMt99zfMmlrh1RV+apUItSvrpSVC9MoS:ED2qmQ4FzBvvC5cY0t9fDrhtCMMOHEjS

Score
8/10
persistence

Malware Config

Targets

    • Target

      d075e6f5a56bbf4f5111088e8ea92ced1b833287031fec3a9c9c30d2edadbb0a

    • Size

      1.1MB

    • MD5

      5e1c2e6f9198085ba91feadb94f1b368

    • SHA1

      354423c09e50fd8cbafedd104dd90efd6a52b691

    • SHA256

      d075e6f5a56bbf4f5111088e8ea92ced1b833287031fec3a9c9c30d2edadbb0a

    • SHA512

      df7b712fe79f9d6b58b11515830a8e72891fd9db9cd51e9e1f53515be5d48382f45d39467150f2601a03891d176b4e5009c1fa276be4ef749799294d9e7008b7

    • SSDEEP

      12288:EX87M0uZr2qmQ4FkK88BibQmGC5cYibZUMt99zfMmlrh1RV+apUItSvrpSVC9MoS:ED2qmQ4FzBvvC5cY0t9fDrhtCMMOHEjS

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks