Overview

overview

10

Static

static

7

104c32a601...3N.exe

windows7-x64

10

104c32a601...3N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    104c32a6016af8a2982a38743ac56717400319604e62cdba3b3313e32f2a8ec3N

  • Size

    2.4MB

  • Sample

    240921-ypqgtazgna

  • MD5

    acdc85704cd3c181358248ea1865fcf0

  • SHA1

    37f39d46489aea48d585513662f42c5e6a8a267a

  • SHA256

    104c32a6016af8a2982a38743ac56717400319604e62cdba3b3313e32f2a8ec3

  • SHA512

    6f4b2674ca158e442e78829ae46ed27404f7becc6dbed84cdc33f8a26331f329f6a74085c073b126593b894dff86906a1e874c14e55916ae242cb8f2e7d194ba

  • SSDEEP

    49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6o:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtty

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      104c32a6016af8a2982a38743ac56717400319604e62cdba3b3313e32f2a8ec3N

    • Size

      2.4MB

    • MD5

      acdc85704cd3c181358248ea1865fcf0

    • SHA1

      37f39d46489aea48d585513662f42c5e6a8a267a

    • SHA256

      104c32a6016af8a2982a38743ac56717400319604e62cdba3b3313e32f2a8ec3

    • SHA512

      6f4b2674ca158e442e78829ae46ed27404f7becc6dbed84cdc33f8a26331f329f6a74085c073b126593b894dff86906a1e874c14e55916ae242cb8f2e7d194ba

    • SSDEEP

      49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6o:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtty

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks