Overview

overview

10

Static

static

3

a2d188f26f...23.exe

windows7-x64

10

a2d188f26f...23.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a2d188f26f6489960c80249f2d7d4623

  • Size

    199KB

  • Sample

    240224-1l5hnsfc57

  • MD5

    a2d188f26f6489960c80249f2d7d4623

  • SHA1

    6a485c320e1563e0c8c5d043b6c31f84b1277a6c

  • SHA256

    f0e1231ee4bad22b5b13a3197ab0d7e98cd1cee7e34825722bb4e11f349018c9

  • SHA512

    8c6d058bba5efecd05b703521c59544bd4ba2418d4ab622e79e7d857996f58fbcbd90a92f9c8f07988d142a9887775138969af0747c794854732b105a53207f0

  • SSDEEP

    3072:9msKGgOkGqHmT76JidYL49Nw/fnQRi6RwhGpVAv6IQ9BiQ:9JqHmTieNwnKh5NZ9b

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      a2d188f26f6489960c80249f2d7d4623

    • Size

      199KB

    • MD5

      a2d188f26f6489960c80249f2d7d4623

    • SHA1

      6a485c320e1563e0c8c5d043b6c31f84b1277a6c

    • SHA256

      f0e1231ee4bad22b5b13a3197ab0d7e98cd1cee7e34825722bb4e11f349018c9

    • SHA512

      8c6d058bba5efecd05b703521c59544bd4ba2418d4ab622e79e7d857996f58fbcbd90a92f9c8f07988d142a9887775138969af0747c794854732b105a53207f0

    • SSDEEP

      3072:9msKGgOkGqHmT76JidYL49Nw/fnQRi6RwhGpVAv6IQ9BiQ:9JqHmTieNwnKh5NZ9b

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks