Overview

overview

10

Static

static

1

0ef148055e...da.one

windows7-x64

10

0ef148055e...da.one

windows10-2004-x64

10

Resubmissions

24/04/2023, 12:34

230424-pr1wwsbg72 10

24/04/2023, 12:28

230424-pnbsladd6y 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda

  • Size

    2.8MB

  • Sample

    230424-pnbsladd6y

  • MD5

    cbe556164d8ee03c93fa5db83fa4dbcf

  • SHA1

    91f785f85880003c81cd210c23199615d5e0a678

  • SHA256

    0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda

  • SHA512

    88229b3a9bf8085be0e7ec4948907b92916cfee46d4abeb6637dc39571871bf7dee49f2be8e378dc802f7e35d317e6471d599962000ebff35cb4f7a7c5923a8b

  • SSDEEP

    49152:yrFGOOTLCTFQq5iNZ4hS5WPvwaqB/nREYVoB5JSHawNxx:drTLmTpc/nREYKd8

Score
10/10

Malware Config

Targets

    • Target

      0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda

    • Size

      2.8MB

    • MD5

      cbe556164d8ee03c93fa5db83fa4dbcf

    • SHA1

      91f785f85880003c81cd210c23199615d5e0a678

    • SHA256

      0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda

    • SHA512

      88229b3a9bf8085be0e7ec4948907b92916cfee46d4abeb6637dc39571871bf7dee49f2be8e378dc802f7e35d317e6471d599962000ebff35cb4f7a7c5923a8b

    • SSDEEP

      49152:yrFGOOTLCTFQq5iNZ4hS5WPvwaqB/nREYVoB5JSHawNxx:drTLmTpc/nREYKd8

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks