Overview

overview

10

Static

static

3

0f0ea26489...fe.xll

windows7-x64

7

0f0ea26489...fe.xll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f0ea26489cbc25a14675b8a26f0d30b19123571464e6c32b4b757511b46e2fe

  • Size

    12KB

  • Sample

    240522-vztensad9s

  • MD5

    f66ff35fbe9c27e3d73091ef6b944f64

  • SHA1

    f6740d0b3e098074007b26eeceeb407f9db25a3b

  • SHA256

    0f0ea26489cbc25a14675b8a26f0d30b19123571464e6c32b4b757511b46e2fe

  • SHA512

    9566f25e24a58d9c25e73d043a325b9d156df0d4e48fbed2e39b71b2cf6d5f60d09e1ee2f4d3168eb5a4f76e731f624f3ee2afbbf8508d3b0c1b4eb04cf66802

  • SSDEEP

    192:4L29RBzDzeobchBj8JON+ONfVruzrEPEjr7Ah9:229jnbcvYJOPdNuzvr7C9

Score
10/10
execution

Malware Config

Targets

    • Target

      0f0ea26489cbc25a14675b8a26f0d30b19123571464e6c32b4b757511b46e2fe

    • Size

      12KB

    • MD5

      f66ff35fbe9c27e3d73091ef6b944f64

    • SHA1

      f6740d0b3e098074007b26eeceeb407f9db25a3b

    • SHA256

      0f0ea26489cbc25a14675b8a26f0d30b19123571464e6c32b4b757511b46e2fe

    • SHA512

      9566f25e24a58d9c25e73d043a325b9d156df0d4e48fbed2e39b71b2cf6d5f60d09e1ee2f4d3168eb5a4f76e731f624f3ee2afbbf8508d3b0c1b4eb04cf66802

    • SSDEEP

      192:4L29RBzDzeobchBj8JON+ONfVruzrEPEjr7Ah9:229jnbcvYJOPdNuzvr7C9

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks