Overview

overview

9

Static

static

3

ac02be9988...23.exe

windows7-x64

1

ac02be9988...23.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    ac02be9988e6f4c84a635be51adc519abb83b39d585eb605eb16db4dcb2eb123

  • Size

    88KB

  • Sample

    240319-krzxdagb8x

  • MD5

    96e6ef7791049535c89b6b2db75bf987

  • SHA1

    c686ffc0696a224ca68ced7cb753ccd904eb7b4b

  • SHA256

    ac02be9988e6f4c84a635be51adc519abb83b39d585eb605eb16db4dcb2eb123

  • SHA512

    465ffdd1289cb9f0404413c1307b833cd0e33f5e7a22ccffbc237c14ce05753a0a200977f38ff03ffaa08c15b4ae4b01bedf60eaf9b39c967e6549460a03d312

  • SSDEEP

    1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yEd:6D0ctAVA/bmxIMnoKjyR/Nd

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      ac02be9988e6f4c84a635be51adc519abb83b39d585eb605eb16db4dcb2eb123

    • Size

      88KB

    • MD5

      96e6ef7791049535c89b6b2db75bf987

    • SHA1

      c686ffc0696a224ca68ced7cb753ccd904eb7b4b

    • SHA256

      ac02be9988e6f4c84a635be51adc519abb83b39d585eb605eb16db4dcb2eb123

    • SHA512

      465ffdd1289cb9f0404413c1307b833cd0e33f5e7a22ccffbc237c14ce05753a0a200977f38ff03ffaa08c15b4ae4b01bedf60eaf9b39c967e6549460a03d312

    • SSDEEP

      1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yEd:6D0ctAVA/bmxIMnoKjyR/Nd

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks