Overview

overview

10

Static

static

7

c1d5297ee8...0N.exe

windows7-x64

10

c1d5297ee8...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c1d5297ee8735c4393639b686d6b6270N.exe

  • Size

    1.8MB

  • Sample

    240909-xa1tkavhlg

  • MD5

    c1d5297ee8735c4393639b686d6b6270

  • SHA1

    7aa5bbfa7b73a4fda0d63ce4fb4cc36e699f7bba

  • SHA256

    30bb5bb7e51d28d6a352acdb6fb1b6be88ffe2d781d0041f785af9c2cdf5cc0f

  • SHA512

    d470ecc45fc7613370e7d554265764e0afedc4f09c59dbeb42d410edca72cfccd02c4e7cdcd95660bcb9ac2eee1f6c7311bd90805ae6b9a9691e027f1162d71e

  • SSDEEP

    49152:qVA4fBDGeLp63a3/cKgzR/iJdIwQZFJD68dGYWPbmnq0G2SImeGf0g+gS6ZI8u43:qVA4fBDGeLp6K3/cKgzR/iJdIwQZFJDA

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      c1d5297ee8735c4393639b686d6b6270N.exe

    • Size

      1.8MB

    • MD5

      c1d5297ee8735c4393639b686d6b6270

    • SHA1

      7aa5bbfa7b73a4fda0d63ce4fb4cc36e699f7bba

    • SHA256

      30bb5bb7e51d28d6a352acdb6fb1b6be88ffe2d781d0041f785af9c2cdf5cc0f

    • SHA512

      d470ecc45fc7613370e7d554265764e0afedc4f09c59dbeb42d410edca72cfccd02c4e7cdcd95660bcb9ac2eee1f6c7311bd90805ae6b9a9691e027f1162d71e

    • SSDEEP

      49152:qVA4fBDGeLp63a3/cKgzR/iJdIwQZFJD68dGYWPbmnq0G2SImeGf0g+gS6ZI8u43:qVA4fBDGeLp6K3/cKgzR/iJdIwQZFJDA

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks