Overview

overview

10

Static

static

7

248a5c1ef9...6f.exe

windows7-x64

10

248a5c1ef9...6f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    248a5c1ef93baa512192d26f62dbb505628e874f61119b87793e16ef6764566f

  • Size

    1.1MB

  • Sample

    231011-kcs6aabc7t

  • MD5

    ad3bbd955c15dc9c0704c4830fab4392

  • SHA1

    b82360e64607a92bf16ee0a543a324a3ce457a87

  • SHA256

    248a5c1ef93baa512192d26f62dbb505628e874f61119b87793e16ef6764566f

  • SHA512

    daf4cad977c8a7043819399f89b314ab45543c6aef383a34790254cc3eb0a11e67e5f14ad527e05fdfdcd25a46053a4c712905721ac9efd43ef3dd0bc8469c0a

  • SSDEEP

    12288:xqXUHkUXe3GOkx2LIaKMgdBQGb1wyyy0/n:xjHPO2Okx2LFKMgdBQGpA

Score
10/10
upx

Malware Config

Targets

    • Target

      248a5c1ef93baa512192d26f62dbb505628e874f61119b87793e16ef6764566f

    • Size

      1.1MB

    • MD5

      ad3bbd955c15dc9c0704c4830fab4392

    • SHA1

      b82360e64607a92bf16ee0a543a324a3ce457a87

    • SHA256

      248a5c1ef93baa512192d26f62dbb505628e874f61119b87793e16ef6764566f

    • SHA512

      daf4cad977c8a7043819399f89b314ab45543c6aef383a34790254cc3eb0a11e67e5f14ad527e05fdfdcd25a46053a4c712905721ac9efd43ef3dd0bc8469c0a

    • SSDEEP

      12288:xqXUHkUXe3GOkx2LIaKMgdBQGb1wyyy0/n:xjHPO2Okx2LFKMgdBQGpA

    Score
    10/10
    upx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks