Overview

overview

10

Static

static

10

0aa2292189...da.exe

windows7-x64

9

0aa2292189...da.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0aa2292189e7e63f15112f0cb3fab5b1ed30d6365acda218730dbc40f78b9ada

  • Size

    134KB

  • Sample

    240611-w6vrrawhlb

  • MD5

    6b1bad536c46554ec1028b0f69c3d250

  • SHA1

    25a1225122029522b51c191d637c5a79958c63c1

  • SHA256

    0aa2292189e7e63f15112f0cb3fab5b1ed30d6365acda218730dbc40f78b9ada

  • SHA512

    fc21931a807ad631b8f8b7a3355ff4a55f9003de089fe67211c21c3905d8377b7dae7274312492dc68fea4718c4667aef998764d56756e75ba1134422ac01542

  • SSDEEP

    1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOU:YfU/WF6QMauSuiWNi9eNOl0007NZIOU

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      0aa2292189e7e63f15112f0cb3fab5b1ed30d6365acda218730dbc40f78b9ada

    • Size

      134KB

    • MD5

      6b1bad536c46554ec1028b0f69c3d250

    • SHA1

      25a1225122029522b51c191d637c5a79958c63c1

    • SHA256

      0aa2292189e7e63f15112f0cb3fab5b1ed30d6365acda218730dbc40f78b9ada

    • SHA512

      fc21931a807ad631b8f8b7a3355ff4a55f9003de089fe67211c21c3905d8377b7dae7274312492dc68fea4718c4667aef998764d56756e75ba1134422ac01542

    • SSDEEP

      1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOU:YfU/WF6QMauSuiWNi9eNOl0007NZIOU

    Score
    9/10
    persistenceupx

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks