Overview

overview

10

Static

static

7

2e07e1dde0...84.exe

windows7-x64

10

2e07e1dde0...84.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2e07e1dde020eee00a69fbb959fc5620a3e08c63f48b74d9270b4aa4a5f93584

  • Size

    1.1MB

  • Sample

    231004-kqe6kscb78

  • MD5

    d5fc28331a65ffe0aa7aa890bef964ab

  • SHA1

    e78035e69dfd105195d3e0cce2ded119b75e3661

  • SHA256

    2e07e1dde020eee00a69fbb959fc5620a3e08c63f48b74d9270b4aa4a5f93584

  • SHA512

    27ae56969317d5bd09a873cb07731684109a73d09d755cafc8b0d915245c057fe94730acd1066983547738eca0ee82dd3f583fdfcf592fb26d26646bf7cadcb4

  • SSDEEP

    6144:dl51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa51BgVWWStmyyye/:bqXUHkUXe3GOkx2LIazBg0tmyyyI

Score
10/10
upx

Malware Config

Targets

    • Target

      2e07e1dde020eee00a69fbb959fc5620a3e08c63f48b74d9270b4aa4a5f93584

    • Size

      1.1MB

    • MD5

      d5fc28331a65ffe0aa7aa890bef964ab

    • SHA1

      e78035e69dfd105195d3e0cce2ded119b75e3661

    • SHA256

      2e07e1dde020eee00a69fbb959fc5620a3e08c63f48b74d9270b4aa4a5f93584

    • SHA512

      27ae56969317d5bd09a873cb07731684109a73d09d755cafc8b0d915245c057fe94730acd1066983547738eca0ee82dd3f583fdfcf592fb26d26646bf7cadcb4

    • SSDEEP

      6144:dl51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa51BgVWWStmyyye/:bqXUHkUXe3GOkx2LIazBg0tmyyyI

    Score
    10/10
    upx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks