Overview

overview

10

Static

static

7

bc480efe59...0N.exe

windows7-x64

10

bc480efe59...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bc480efe599e7b487208f8cb83fc7e20N

  • Size

    1.7MB

  • Sample

    240912-2ee5wayckl

  • MD5

    bc480efe599e7b487208f8cb83fc7e20

  • SHA1

    94f287527813b5c904c1e57e584f8857f56dab96

  • SHA256

    cf03550216d704164f2ed95035e5c4860d7470bb36eb38750564473090a5e2bc

  • SHA512

    131555f4503ecbc6736b90a9b51a9b3b090f5c14d323668303362601385d899b470c7cc662bf4cc6692df7f4b0d50f4ba26eed12ab6b42bd57d4b5d1771ce255

  • SSDEEP

    12288:Xvk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYi2oSt:s1zltpu0is

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      bc480efe599e7b487208f8cb83fc7e20N

    • Size

      1.7MB

    • MD5

      bc480efe599e7b487208f8cb83fc7e20

    • SHA1

      94f287527813b5c904c1e57e584f8857f56dab96

    • SHA256

      cf03550216d704164f2ed95035e5c4860d7470bb36eb38750564473090a5e2bc

    • SHA512

      131555f4503ecbc6736b90a9b51a9b3b090f5c14d323668303362601385d899b470c7cc662bf4cc6692df7f4b0d50f4ba26eed12ab6b42bd57d4b5d1771ce255

    • SSDEEP

      12288:Xvk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYi2oSt:s1zltpu0is

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks