Overview

overview

8

Static

static

3

14a10ef4f6...95.exe

windows7-x64

1

14a10ef4f6...95.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95

  • Size

    315KB

  • Sample

    231007-a46wcage9w

  • MD5

    999d17f66b6e237453ad899d94fb6998

  • SHA1

    fec99ee5b5e7d1e1f13ee69208292921a843a0bd

  • SHA256

    14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95

  • SHA512

    ba8e66801fcf49e6e5bcd74b03760f35d13060fee0c1e66daa8117976f8ae6e995acfc9208c44679425ba06b1d9bce86fb22d7ec867cc71ab7cf291cd811d99b

  • SSDEEP

    6144:UD0AJsZbY+kdRpmXmfFgjYEIyv49iVt//Vzo+F0w3qmsTcKSK:K0AJ1+8RpmXmfFgjYEIyv49KnB5fiLS

Score
8/10
persistence

Malware Config

Targets

    • Target

      14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95

    • Size

      315KB

    • MD5

      999d17f66b6e237453ad899d94fb6998

    • SHA1

      fec99ee5b5e7d1e1f13ee69208292921a843a0bd

    • SHA256

      14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95

    • SHA512

      ba8e66801fcf49e6e5bcd74b03760f35d13060fee0c1e66daa8117976f8ae6e995acfc9208c44679425ba06b1d9bce86fb22d7ec867cc71ab7cf291cd811d99b

    • SSDEEP

      6144:UD0AJsZbY+kdRpmXmfFgjYEIyv49iVt//Vzo+F0w3qmsTcKSK:K0AJ1+8RpmXmfFgjYEIyv49KnB5fiLS

    Score
    8/10
    persistence

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks