Overview

overview

10

Static

static

10

3aa82091b8...ec.exe

windows7-x64

9

3aa82091b8...ec.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    3aa82091b8ee8c5de41b8a7ef0ff0c2f3781261b6b7b9daec3534d30dea846ec

  • Size

    48KB

  • Sample

    240415-y72b2ahf3w

  • MD5

    d910d1dc121204abb0694d4994984157

  • SHA1

    8ffa20185d51c613b3e4c93f5bf91a25e9aeb11a

  • SHA256

    3aa82091b8ee8c5de41b8a7ef0ff0c2f3781261b6b7b9daec3534d30dea846ec

  • SHA512

    42f725fa6a25e9f395653ec47679909b7509ce5dad1c311c2bb9285529a4fe6734fc21c77ba3c0a8b8c9d7194c007722f6fe6f39bbfe55286e235cb77e87e94a

  • SSDEEP

    1536:yoMuwospyudrnMjVhDIP4ka3q3oaQOF4nouy8BB:DMcsEknMLDIFEOKoutBB

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      3aa82091b8ee8c5de41b8a7ef0ff0c2f3781261b6b7b9daec3534d30dea846ec

    • Size

      48KB

    • MD5

      d910d1dc121204abb0694d4994984157

    • SHA1

      8ffa20185d51c613b3e4c93f5bf91a25e9aeb11a

    • SHA256

      3aa82091b8ee8c5de41b8a7ef0ff0c2f3781261b6b7b9daec3534d30dea846ec

    • SHA512

      42f725fa6a25e9f395653ec47679909b7509ce5dad1c311c2bb9285529a4fe6734fc21c77ba3c0a8b8c9d7194c007722f6fe6f39bbfe55286e235cb77e87e94a

    • SSDEEP

      1536:yoMuwospyudrnMjVhDIP4ka3q3oaQOF4nouy8BB:DMcsEknMLDIFEOKoutBB

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks