Overview

overview

10

Static

static

7

33742f8d8e...b9.exe

windows7-x64

10

33742f8d8e...b9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    33742f8d8ed9e41eddd4476148147bc6b13b0fb28b0d672d6885f532ae40ccb9

  • Size

    271KB

  • Sample

    231002-jb58sahg93

  • MD5

    18ea3bda113cdecd2c9a077d0850b4a5

  • SHA1

    8d4e76636671487d3a11084d46821a18b61a0b96

  • SHA256

    33742f8d8ed9e41eddd4476148147bc6b13b0fb28b0d672d6885f532ae40ccb9

  • SHA512

    c0a54c30d2d100911501c9f0c89be6c301c0e4ff345b7b85bbcd95d837abac63ef0cc84e5fc2f4794a3c277eb004d694b5b7ba4b57a70c7975769f68ef56b512

  • SSDEEP

    6144:8l51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa:gqXUHkUXe3GOkx2LIa

Score
10/10
upx

Malware Config

Targets

    • Target

      33742f8d8ed9e41eddd4476148147bc6b13b0fb28b0d672d6885f532ae40ccb9

    • Size

      271KB

    • MD5

      18ea3bda113cdecd2c9a077d0850b4a5

    • SHA1

      8d4e76636671487d3a11084d46821a18b61a0b96

    • SHA256

      33742f8d8ed9e41eddd4476148147bc6b13b0fb28b0d672d6885f532ae40ccb9

    • SHA512

      c0a54c30d2d100911501c9f0c89be6c301c0e4ff345b7b85bbcd95d837abac63ef0cc84e5fc2f4794a3c277eb004d694b5b7ba4b57a70c7975769f68ef56b512

    • SSDEEP

      6144:8l51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa:gqXUHkUXe3GOkx2LIa

    Score
    10/10
    upx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks