Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.2MB

  • Sample

    240602-nye3bscf84

  • MD5

    deafbdc620c448f30ed765cea21bd8d4

  • SHA1

    4e4d5221e80640d29976cc0660067d884574ea2a

  • SHA256

    d8558fe78f5016bde05a841d05d094bc7fe040b36f6d195ae33ece9fa4b0f9e6

  • SHA512

    58794328ee3e4e8732dd1ec36a7178455bff1bae8431d6394e389a15cd5b8ce55e1709308f8b7861f38bb31a30a4017d71fd0a214084fb07bfcf723c5fd55c07

  • SSDEEP

    24576:FTAPa5NuIM072aCVm4Yzs4M9SP8/Ec+CsrL5WyI2YsAeG:FT9eITD6m4Z4MAEaWAr

Score
10/10
execution

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.2MB

    • MD5

      deafbdc620c448f30ed765cea21bd8d4

    • SHA1

      4e4d5221e80640d29976cc0660067d884574ea2a

    • SHA256

      d8558fe78f5016bde05a841d05d094bc7fe040b36f6d195ae33ece9fa4b0f9e6

    • SHA512

      58794328ee3e4e8732dd1ec36a7178455bff1bae8431d6394e389a15cd5b8ce55e1709308f8b7861f38bb31a30a4017d71fd0a214084fb07bfcf723c5fd55c07

    • SSDEEP

      24576:FTAPa5NuIM072aCVm4Yzs4M9SP8/Ec+CsrL5WyI2YsAeG:FT9eITD6m4Z4MAEaWAr

    Score
    10/10
    execution

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks