Overview

overview

10

Static

static

7

97a4c1d1fe...20.exe

windows7-x64

10

97a4c1d1fe...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    97a4c1d1febbc4d144cb68c50bb456aa48ff588312f2e2a1be7f25840b211420

  • Size

    2.0MB

  • Sample

    240813-2l82jazfla

  • MD5

    0fa77509a2bb2278c37711f87e415f68

  • SHA1

    f6f23401e0fb8925b3a1536c1d8fb50daf941156

  • SHA256

    97a4c1d1febbc4d144cb68c50bb456aa48ff588312f2e2a1be7f25840b211420

  • SHA512

    734e2b1f8fd190421607e0603902361e33e22431884c561cb0dc57f3850c50b3ecd8549855b4b8658218d234769a9da6a1c6a7f85ee8400fe219ecfb79d8c515

  • SSDEEP

    49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWZ:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaq

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      97a4c1d1febbc4d144cb68c50bb456aa48ff588312f2e2a1be7f25840b211420

    • Size

      2.0MB

    • MD5

      0fa77509a2bb2278c37711f87e415f68

    • SHA1

      f6f23401e0fb8925b3a1536c1d8fb50daf941156

    • SHA256

      97a4c1d1febbc4d144cb68c50bb456aa48ff588312f2e2a1be7f25840b211420

    • SHA512

      734e2b1f8fd190421607e0603902361e33e22431884c561cb0dc57f3850c50b3ecd8549855b4b8658218d234769a9da6a1c6a7f85ee8400fe219ecfb79d8c515

    • SSDEEP

      49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWZ:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaq

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks