Overview

overview

9

Static

static

3

55746ab43a...49.exe

windows7-x64

9

55746ab43a...49.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849

  • Size

    88KB

  • Sample

    240522-1nwnjsaa4t

  • MD5

    3b47dbab8b41ccc785f7e06e19eb2908

  • SHA1

    3c023ffbf16c24f5725f6fd63a5cc24f8decbf23

  • SHA256

    55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849

  • SHA512

    2d7273d301856774716de14d228c13abd96d96174e5879503f9347c8b63165c51790c710bd1d0d8af9803b58ce36307bea4228e3e530d1babd74cf216c79751d

  • SSDEEP

    1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849

    • Size

      88KB

    • MD5

      3b47dbab8b41ccc785f7e06e19eb2908

    • SHA1

      3c023ffbf16c24f5725f6fd63a5cc24f8decbf23

    • SHA256

      55746ab43a9873111030c4892f188251f4b3ce13417f438af9b9f72ba1625849

    • SHA512

      2d7273d301856774716de14d228c13abd96d96174e5879503f9347c8b63165c51790c710bd1d0d8af9803b58ce36307bea4228e3e530d1babd74cf216c79751d

    • SSDEEP

      1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks