Overview

overview

10

Static

static

3

9a06a7e566...0N.exe

windows7-x64

10

9a06a7e566...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9a06a7e566ae1d2b9b3786d0cac09e60N.exe

  • Size

    1.6MB

  • Sample

    240824-1xfnpatfmj

  • MD5

    9a06a7e566ae1d2b9b3786d0cac09e60

  • SHA1

    d193bdddd569278e4bfec1d85eb80340ffd42a34

  • SHA256

    77efbef573a744cad4c5907d09790ead222a2530627b2dff9a16b61d131b1103

  • SHA512

    41847197d9eb34e1f1870ba522bca0e9748b1f816a74c76c9fd58707136378b5dd5a6d32c3bb12d03b855142a4effd00eb23f469b285d4556da9a57caa2f7db0

  • SSDEEP

    12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYiJ:h1zltpu0iJ

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      9a06a7e566ae1d2b9b3786d0cac09e60N.exe

    • Size

      1.6MB

    • MD5

      9a06a7e566ae1d2b9b3786d0cac09e60

    • SHA1

      d193bdddd569278e4bfec1d85eb80340ffd42a34

    • SHA256

      77efbef573a744cad4c5907d09790ead222a2530627b2dff9a16b61d131b1103

    • SHA512

      41847197d9eb34e1f1870ba522bca0e9748b1f816a74c76c9fd58707136378b5dd5a6d32c3bb12d03b855142a4effd00eb23f469b285d4556da9a57caa2f7db0

    • SSDEEP

      12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYiJ:h1zltpu0iJ

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks