Overview

overview

10

Static

static

7

f80069df09...e7.exe

windows7-x64

10

f80069df09...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f80069df091601fe57a1460fd847b997453f0669402b760c94765df09bacc7e7

  • Size

    2.4MB

  • Sample

    231011-wpjm6afc95

  • MD5

    9e8c5b20c0bd22166dc74e5f49c02dfa

  • SHA1

    b2a1752de58b577b725f07db7ffbf7a5461760df

  • SHA256

    f80069df091601fe57a1460fd847b997453f0669402b760c94765df09bacc7e7

  • SHA512

    17ae65beac57b43943f473e811988e7d882b4e10d561a20b543b4c325ac32fda063470cfeb6f17ce794ece62a8db30c9e87f48717bd5bd0ce9b5186cab938ba2

  • SSDEEP

    49152:16m/JTvdK0PQ50YAaVo8oP3KpuZj3QcG2jGnYALfQgV:1L/JRKItI

Score
10/10
upx

Malware Config

Targets

    • Target

      f80069df091601fe57a1460fd847b997453f0669402b760c94765df09bacc7e7

    • Size

      2.4MB

    • MD5

      9e8c5b20c0bd22166dc74e5f49c02dfa

    • SHA1

      b2a1752de58b577b725f07db7ffbf7a5461760df

    • SHA256

      f80069df091601fe57a1460fd847b997453f0669402b760c94765df09bacc7e7

    • SHA512

      17ae65beac57b43943f473e811988e7d882b4e10d561a20b543b4c325ac32fda063470cfeb6f17ce794ece62a8db30c9e87f48717bd5bd0ce9b5186cab938ba2

    • SSDEEP

      49152:16m/JTvdK0PQ50YAaVo8oP3KpuZj3QcG2jGnYALfQgV:1L/JRKItI

    Score
    10/10
    upx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks