Overview

overview

10

Static

static

10

71a092f280...18.exe

windows7-x64

10

71a092f280...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    71a092f280b81279a808c8d1693eb2742538d8f48db7add7c78a89def066a318

  • Size

    293KB

  • Sample

    240619-26c5la1akm

  • MD5

    24391c237c9974808a9ff954e89a0483

  • SHA1

    011d64c6406797f359d49d5991af5e88f5c1d5ec

  • SHA256

    71a092f280b81279a808c8d1693eb2742538d8f48db7add7c78a89def066a318

  • SHA512

    1ea00c2c98e70e12b9183d107ad6de0268d4790a4eb08cf0b988a87fa56879bb17ac21165549a028c121625c10d223abc594920e8251263a90d5fd9cceb7693b

  • SSDEEP

    6144:g750HizPy7n+g47wSAr2QxMcnpjRBM8Aat6E5PB0beIwa2pX8EIHBZrfxoS4iJe:Diz+n87tArhxVjVAA6aPBwSXrk7rJoSA

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      71a092f280b81279a808c8d1693eb2742538d8f48db7add7c78a89def066a318

    • Size

      293KB

    • MD5

      24391c237c9974808a9ff954e89a0483

    • SHA1

      011d64c6406797f359d49d5991af5e88f5c1d5ec

    • SHA256

      71a092f280b81279a808c8d1693eb2742538d8f48db7add7c78a89def066a318

    • SHA512

      1ea00c2c98e70e12b9183d107ad6de0268d4790a4eb08cf0b988a87fa56879bb17ac21165549a028c121625c10d223abc594920e8251263a90d5fd9cceb7693b

    • SSDEEP

      6144:g750HizPy7n+g47wSAr2QxMcnpjRBM8Aat6E5PB0beIwa2pX8EIHBZrfxoS4iJe:Diz+n87tArhxVjVAA6aPBwSXrk7rJoSA

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks