Overview

overview

10

Static

static

3

420d027e39...67.exe

windows7-x64

10

420d027e39...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    420d027e39579a6ead3c92699ebc7567.exe

  • Size

    460KB

  • Sample

    231231-p1zeesbfar

  • MD5

    420d027e39579a6ead3c92699ebc7567

  • SHA1

    c1c08b77d14d6b33848ee6d04d4a30aafe3d8a08

  • SHA256

    64345c64a8c7d5284c5f47f17bc0a8ab1c3509c278c109718b918ba6f3197317

  • SHA512

    a73921528df774c64579ffe5337c1b5f144ca75ad2949a2d7a739572aa83173e697232fd9d3f16b30f7f01b47815b2a739be6843beb6bb3b91f664b21ff3e631

  • SSDEEP

    12288:glSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:glSt69HNx6T/5xT

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      420d027e39579a6ead3c92699ebc7567.exe

    • Size

      460KB

    • MD5

      420d027e39579a6ead3c92699ebc7567

    • SHA1

      c1c08b77d14d6b33848ee6d04d4a30aafe3d8a08

    • SHA256

      64345c64a8c7d5284c5f47f17bc0a8ab1c3509c278c109718b918ba6f3197317

    • SHA512

      a73921528df774c64579ffe5337c1b5f144ca75ad2949a2d7a739572aa83173e697232fd9d3f16b30f7f01b47815b2a739be6843beb6bb3b91f664b21ff3e631

    • SSDEEP

      12288:glSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:glSt69HNx6T/5xT

    Score
    10/10
    evasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks