bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06 | Triage

Submit
Reports

Overview

overview

Static

static

8

bd0be98a94...06.exe

windows7-x64

bd0be98a94...06.exe

windows10-2004-x64

Sharing

General

Target

bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06
Size

20KB
Sample

221205-x381msha56
MD5

747c16c1e5aafcfaaa461d9a21fa3497
SHA1

f985ce06fd5d408f5d2c9dc6a9089d976e5fde5a
SHA256

bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06
SHA512

33a946958bdd8d66bb7b9bad9754843faa3e579a5e4fc85ee4f5e3792e4c540c0c892d55ebfdb0f100fbd7c42b944a6ec77479e820eb2e4e53718034eb6f12c1
SSDEEP

384:EYY72Y3p62w+9QC+sgQavLuoI24OBC19Gq6LFBlK+VZMuCFDf7b06Mw:Po0REUvVhC+LFBlK+nNClsbw

Score

10^/10

evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06.exe

Resource

win7-20220812-en

evasion persistence trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06.exe

Resource

win10v2004-20221111-en

evasion persistence trojan upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06
- Size
  
  20KB
- MD5
  
  747c16c1e5aafcfaaa461d9a21fa3497
- SHA1
  
  f985ce06fd5d408f5d2c9dc6a9089d976e5fde5a
- SHA256
  
  bd0be98a949b20838a06562ae125846badc8ccc6f5360443668bf78fddfecd06
- SHA512
  
  33a946958bdd8d66bb7b9bad9754843faa3e579a5e4fc85ee4f5e3792e4c540c0c892d55ebfdb0f100fbd7c42b944a6ec77479e820eb2e4e53718034eb6f12c1
- SSDEEP
  
  384:EYY72Y3p62w+9QC+sgQavLuoI24OBC19Gq6LFBlK+VZMuCFDf7b06Mw:Po0REUvVhC+LFBlK+nNClsbw
Score

10^/10

evasion persistence trojan upx
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2024

Terms | Privacy