Overview

overview

8

Static

static

6af2204e4e...ef.exe

windows7-x64

8

6af2204e4e...ef.exe

windows10-2004-x64

8

Resubmissions

10-01-2023 00:57

230110-ba58dsgd29 8

09-01-2023 22:17

230109-17r5gaga66 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6af2204e4e62a5d44462335379f8e70f7d680da84f2a7f6c328fbd40014694ef

  • Size

    1.0MB

  • Sample

    230110-ba58dsgd29

  • MD5

    067b0d35578c2755a06e9e6b702c4c05

  • SHA1

    603edd059b6a616a984ba4582cd86384234ba2d0

  • SHA256

    6af2204e4e62a5d44462335379f8e70f7d680da84f2a7f6c328fbd40014694ef

  • SHA512

    992617a6220a41fde70e3e457b27a1b7474af44d23d501474c8e466e4648ea1a281b277f667434f097dc1808d3299a7b18076e16a924e15aa29319a8f0ff0595

  • SSDEEP

    12288:u9iJB1C4k6XXEdR16EjdL7in0DpEXhZV8F9jL2FvEd/0rhFyYcvFb+BCFhyP8+:uoJuFfHjpsZVAv/0ruYctb+YFQ

Score
8/10
persistence

Malware Config

Targets

    • Target

      6af2204e4e62a5d44462335379f8e70f7d680da84f2a7f6c328fbd40014694ef

    • Size

      1.0MB

    • MD5

      067b0d35578c2755a06e9e6b702c4c05

    • SHA1

      603edd059b6a616a984ba4582cd86384234ba2d0

    • SHA256

      6af2204e4e62a5d44462335379f8e70f7d680da84f2a7f6c328fbd40014694ef

    • SHA512

      992617a6220a41fde70e3e457b27a1b7474af44d23d501474c8e466e4648ea1a281b277f667434f097dc1808d3299a7b18076e16a924e15aa29319a8f0ff0595

    • SSDEEP

      12288:u9iJB1C4k6XXEdR16EjdL7in0DpEXhZV8F9jL2FvEd/0rhFyYcvFb+BCFhyP8+:uoJuFfHjpsZVAv/0ruYctb+YFQ

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks