Overview

overview

10

Static

static

3

4947a7ca5d...eN.exe

windows7-x64

7

4947a7ca5d...eN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4947a7ca5dd502437c3ac0d160be0b1b3285f1071f902226360f46c2abe28d6eN

  • Size

    79KB

  • Sample

    241004-mp4hwstdmd

  • MD5

    f5699086ca2fa24380a4785bc335f4d0

  • SHA1

    e438b2bbab4cb995620aa5b54737885e297f345b

  • SHA256

    4947a7ca5dd502437c3ac0d160be0b1b3285f1071f902226360f46c2abe28d6e

  • SHA512

    3f618462c924ff57c4f88cb835e1c80b8a13a2301114a3034fe894e3d3c1832054ac0ae533f3a7e4714f6ac1f32ffa4ac629d23e070c22a7d3f9d213788943e5

  • SSDEEP

    1536:nQxqcQu0iQ0KsgFWq/fpZl9c4QFABNitT2xLoxqxSny:Q/030KtFpBZnc4IABNhxLVUny

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      4947a7ca5dd502437c3ac0d160be0b1b3285f1071f902226360f46c2abe28d6eN

    • Size

      79KB

    • MD5

      f5699086ca2fa24380a4785bc335f4d0

    • SHA1

      e438b2bbab4cb995620aa5b54737885e297f345b

    • SHA256

      4947a7ca5dd502437c3ac0d160be0b1b3285f1071f902226360f46c2abe28d6e

    • SHA512

      3f618462c924ff57c4f88cb835e1c80b8a13a2301114a3034fe894e3d3c1832054ac0ae533f3a7e4714f6ac1f32ffa4ac629d23e070c22a7d3f9d213788943e5

    • SSDEEP

      1536:nQxqcQu0iQ0KsgFWq/fpZl9c4QFABNitT2xLoxqxSny:Q/030KtFpBZnc4IABNhxLVUny

    Score
    10/10
    discoveryupxpersistence

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks