Overview

overview

10

Static

static

7

4818636521...16.exe

windows7-x64

10

4818636521...16.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    48186365216fc65399a1993865d03b35671ee612f53a7e2344b8f4438cb4ab16

  • Size

    223KB

  • Sample

    231113-j2k1jabd7x

  • MD5

    9d03ac6f029b8a34a32bd7b4a20d0afa

  • SHA1

    91320d21500789f2134cb65c1b63907503fbcae8

  • SHA256

    48186365216fc65399a1993865d03b35671ee612f53a7e2344b8f4438cb4ab16

  • SHA512

    dfec2c018dfd8e0ea3924367b7c716afac6512686d1bf29e8353560048a246678913dbe173ad9e49d3143114b85d27538f4e3d872b84cb2cb335d5cbd6f14123

  • SSDEEP

    6144:ewPSUONLNsuWA7koN+boRhZ2VUUaSaE0A6Xvd2:eOuW5o/oVU1r5w

Score
10/10
upx

Malware Config

Targets

    • Target

      48186365216fc65399a1993865d03b35671ee612f53a7e2344b8f4438cb4ab16

    • Size

      223KB

    • MD5

      9d03ac6f029b8a34a32bd7b4a20d0afa

    • SHA1

      91320d21500789f2134cb65c1b63907503fbcae8

    • SHA256

      48186365216fc65399a1993865d03b35671ee612f53a7e2344b8f4438cb4ab16

    • SHA512

      dfec2c018dfd8e0ea3924367b7c716afac6512686d1bf29e8353560048a246678913dbe173ad9e49d3143114b85d27538f4e3d872b84cb2cb335d5cbd6f14123

    • SSDEEP

      6144:ewPSUONLNsuWA7koN+boRhZ2VUUaSaE0A6Xvd2:eOuW5o/oVU1r5w

    Score
    10/10
    upx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks