Overview

overview

10

Static

static

7

544aaca1e6...0N.exe

windows7-x64

10

544aaca1e6...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    544aaca1e6cdefe87b3ee01f53943750N

  • Size

    2.4MB

  • Sample

    240825-2bfx1azgkp

  • MD5

    544aaca1e6cdefe87b3ee01f53943750

  • SHA1

    822088c8806e901226fdd5ab632f75aa6476b5ad

  • SHA256

    0a61c8f8f8275cae8b6d30db7310b84c2082cc480a8b0985953f9d31e28ff04a

  • SHA512

    fcb515b78761716f211f12845c3c82157f41020917b1c1e3f06f7b8ec0ce126835e34729a9f025b5c39d7f69ac578015b694ff21ece2e927e86878d3648b44b6

  • SSDEEP

    49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6Q:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      544aaca1e6cdefe87b3ee01f53943750N

    • Size

      2.4MB

    • MD5

      544aaca1e6cdefe87b3ee01f53943750

    • SHA1

      822088c8806e901226fdd5ab632f75aa6476b5ad

    • SHA256

      0a61c8f8f8275cae8b6d30db7310b84c2082cc480a8b0985953f9d31e28ff04a

    • SHA512

      fcb515b78761716f211f12845c3c82157f41020917b1c1e3f06f7b8ec0ce126835e34729a9f025b5c39d7f69ac578015b694ff21ece2e927e86878d3648b44b6

    • SSDEEP

      49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6Q:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks