Overview

overview

7

Static

static

7

4e25f17cba...0N.exe

windows7-x64

7

4e25f17cba...0N.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    4e25f17cbaab1e351d0ff06e1ba7fd40N

  • Size

    155KB

  • Sample

    240825-zm82tawckl

  • MD5

    4e25f17cbaab1e351d0ff06e1ba7fd40

  • SHA1

    09c8be4ddc8f253a366f4fcb8edebb409c638f3e

  • SHA256

    c6c1cf27e87e1fe55fe4ea717e92489fb14bcc4c228d3a4b2d58784de9ab42d9

  • SHA512

    8b244ae3ec3866ea8d4ae0442804e7fed6f4bf1a0934715fb9956bfc0a7ada0f64ecc00063678c225ba81087d009b85e7abae11be27589887ec1916b82339ad6

  • SSDEEP

    3072:e79l86WqGzIfjZAVPXwu7xXIeoutyR9QXh1aQV:erzW/zeZqPpOeoSyQXh0QV

Score
7/10
defense_evasiondiscoverypersistenceupx

Malware Config

Targets

    • Target

      4e25f17cbaab1e351d0ff06e1ba7fd40N

    • Size

      155KB

    • MD5

      4e25f17cbaab1e351d0ff06e1ba7fd40

    • SHA1

      09c8be4ddc8f253a366f4fcb8edebb409c638f3e

    • SHA256

      c6c1cf27e87e1fe55fe4ea717e92489fb14bcc4c228d3a4b2d58784de9ab42d9

    • SHA512

      8b244ae3ec3866ea8d4ae0442804e7fed6f4bf1a0934715fb9956bfc0a7ada0f64ecc00063678c225ba81087d009b85e7abae11be27589887ec1916b82339ad6

    • SSDEEP

      3072:e79l86WqGzIfjZAVPXwu7xXIeoutyR9QXh1aQV:erzW/zeZqPpOeoSyQXh0QV

    Score
    7/10
    defense_evasiondiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks