Overview

overview

8

Static

static

3

85ec36e3d2...ef.exe

windows10-1703-x64

8

85ec36e3d2...ef.exe

windows10-2004-x64

8

85ec36e3d2...ef.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    85ec36e3d25cad7c455ef48ee613acdb732476a8e6b690c3b1850844f83680ef.exe

  • Size

    1.0MB

  • Sample

    240228-rltlqsdf5w

  • MD5

    f00dcb903268d40952f112f1e5e3e92b

  • SHA1

    faca7d57ece3cad3015139640ef27ba7400b482e

  • SHA256

    85ec36e3d25cad7c455ef48ee613acdb732476a8e6b690c3b1850844f83680ef

  • SHA512

    0aacf32e2684e9949f07c1bb49c8379bafa035b86824c0398861a38820f92d806c9bf8d36930662f4ba0848df304af3ebbb688f387f7e2546d1843e0882d4082

  • SSDEEP

    6144:clkgi0e+Kqj6aYD+uUOszAOLjLlP+r0UPdWv:JCe+Kqv0szvfU1Q

Score
8/10
persistence

Malware Config

Targets

    • Target

      85ec36e3d25cad7c455ef48ee613acdb732476a8e6b690c3b1850844f83680ef.exe

    • Size

      1.0MB

    • MD5

      f00dcb903268d40952f112f1e5e3e92b

    • SHA1

      faca7d57ece3cad3015139640ef27ba7400b482e

    • SHA256

      85ec36e3d25cad7c455ef48ee613acdb732476a8e6b690c3b1850844f83680ef

    • SHA512

      0aacf32e2684e9949f07c1bb49c8379bafa035b86824c0398861a38820f92d806c9bf8d36930662f4ba0848df304af3ebbb688f387f7e2546d1843e0882d4082

    • SSDEEP

      6144:clkgi0e+Kqj6aYD+uUOszAOLjLlP+r0UPdWv:JCe+Kqv0szvfU1Q

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks