Overview

overview

10

Static

static

10

bfd9e249d2...ea.exe

windows7-x64

10

bfd9e249d2...ea.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfd9e249d26734b3760b49a7f9b286d2c9ac97f62ad7e711d9e2245d10162aea

  • Size

    2.4MB

  • Sample

    240524-c75tkaae35

  • MD5

    cc2a61a21c9995a1a647f25c3416f9a3

  • SHA1

    76943b37778c5f88efb5bf7beba1fe8475b5f4da

  • SHA256

    bfd9e249d26734b3760b49a7f9b286d2c9ac97f62ad7e711d9e2245d10162aea

  • SHA512

    0d8a33209f8a96882bdbfc0a387dca2054538a8af3d2dfd52b907d3fa36d4fe01c74c4a8843c37e1647836a74eb24c55ecfb41b0de0f3fbe6bd8648be56d9658

  • SSDEEP

    49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6g:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      bfd9e249d26734b3760b49a7f9b286d2c9ac97f62ad7e711d9e2245d10162aea

    • Size

      2.4MB

    • MD5

      cc2a61a21c9995a1a647f25c3416f9a3

    • SHA1

      76943b37778c5f88efb5bf7beba1fe8475b5f4da

    • SHA256

      bfd9e249d26734b3760b49a7f9b286d2c9ac97f62ad7e711d9e2245d10162aea

    • SHA512

      0d8a33209f8a96882bdbfc0a387dca2054538a8af3d2dfd52b907d3fa36d4fe01c74c4a8843c37e1647836a74eb24c55ecfb41b0de0f3fbe6bd8648be56d9658

    • SSDEEP

      49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6g:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks