Overview

overview

9

Static

static

3

main.exe

windows7-x64

9

main.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.exe

  • Size

    1.1MB

  • Sample

    240710-t9tmra1dkb

  • MD5

    1d363ea7301c6c6feaddfc4a591a27cd

  • SHA1

    3677acc29ad990542f05bd86f4b8025c3bc3652d

  • SHA256

    211f14448b9c3d094c384ad365a5e0899f91fd015f138e99edf068b1aac8d3ab

  • SHA512

    acd1824af37a67a754110704eb761325951dfe2732d8f2b967862a951ea47aee6cc5a78a602d3ec612a918612c67ffa41feca66f0882314d6356fa2d5f52bf68

  • SSDEEP

    24576:0jDMacqe/kumuSgsZdRVw8D/Pt9htFEcOuCPtIggndsY0s0:wMce/bcgsVD/PfhfOuQqdF0

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      main.exe

    • Size

      1.1MB

    • MD5

      1d363ea7301c6c6feaddfc4a591a27cd

    • SHA1

      3677acc29ad990542f05bd86f4b8025c3bc3652d

    • SHA256

      211f14448b9c3d094c384ad365a5e0899f91fd015f138e99edf068b1aac8d3ab

    • SHA512

      acd1824af37a67a754110704eb761325951dfe2732d8f2b967862a951ea47aee6cc5a78a602d3ec612a918612c67ffa41feca66f0882314d6356fa2d5f52bf68

    • SSDEEP

      24576:0jDMacqe/kumuSgsZdRVw8D/Pt9htFEcOuCPtIggndsY0s0:wMce/bcgsVD/PfhfOuQqdF0

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (325) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks