c346225d27dd7d5a504cc6e517485b10de8e54cee73840eca31f94d3d036e06e | Triage

Sharing

General

Target

StarX.exe
Size

52KB
Sample

230923-z91c7aae4v
MD5

9e7c9bb992e37e63eaedbcb1c7e0df9c
SHA1

042d1051b07b8f0631223499cf0d72a612110e6c
SHA256

c346225d27dd7d5a504cc6e517485b10de8e54cee73840eca31f94d3d036e06e
SHA512

5116e82484409b2b6888931c765adf06c78365d5ea4d0f61690a4ed5a6c0d3febb44ab79039236f9ae5ce300e0d860f89a463cf2e6d0da6ee0ceb1c1efa5ee71
SSDEEP

1536:4wywEu6xc5sCq0cPRQRV7RZA6ngn6/SZz:4hu9tc09ngn6/SZz

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  StarX.exe
- Size
  
  52KB
- MD5
  
  9e7c9bb992e37e63eaedbcb1c7e0df9c
- SHA1
  
  042d1051b07b8f0631223499cf0d72a612110e6c
- SHA256
  
  c346225d27dd7d5a504cc6e517485b10de8e54cee73840eca31f94d3d036e06e
- SHA512
  
  5116e82484409b2b6888931c765adf06c78365d5ea4d0f61690a4ed5a6c0d3febb44ab79039236f9ae5ce300e0d860f89a463cf2e6d0da6ee0ceb1c1efa5ee71
- SSDEEP
  
  1536:4wywEu6xc5sCq0cPRQRV7RZA6ngn6/SZz:4hu9tc09ngn6/SZz
Score

8^/10

evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2