Overview

overview

7

Static

static

5

b2e9c113bf...dc.exe

windows7-x64

7

b2e9c113bf...dc.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2e9c113bf5dac68b4ead6af290d78d1bf6fb3a21f39f3e3245eb5f46c7749dc

  • Size

    59KB

  • Sample

    241006-bt45fayern

  • MD5

    a07117e95130fb30aa1438e04afbbdbf

  • SHA1

    5835ee054fe52469c873bcde30f0db11a2e54ee8

  • SHA256

    b2e9c113bf5dac68b4ead6af290d78d1bf6fb3a21f39f3e3245eb5f46c7749dc

  • SHA512

    1cb0be3d384f3b3a8e85be190a4275197eee3ccaf3f87e8768de13c1663f95ccb07b85f8c5b3cb7dfc0a66b3b812e07873d4cb5912b98e3acc4e09bd721f3a4b

  • SSDEEP

    1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQo:OeodiUO4p13b9HiIeoutuh1aQo

Score
7/10
defense_evasiondiscoverypersistenceupx

Malware Config

Targets

    • Target

      b2e9c113bf5dac68b4ead6af290d78d1bf6fb3a21f39f3e3245eb5f46c7749dc

    • Size

      59KB

    • MD5

      a07117e95130fb30aa1438e04afbbdbf

    • SHA1

      5835ee054fe52469c873bcde30f0db11a2e54ee8

    • SHA256

      b2e9c113bf5dac68b4ead6af290d78d1bf6fb3a21f39f3e3245eb5f46c7749dc

    • SHA512

      1cb0be3d384f3b3a8e85be190a4275197eee3ccaf3f87e8768de13c1663f95ccb07b85f8c5b3cb7dfc0a66b3b812e07873d4cb5912b98e3acc4e09bd721f3a4b

    • SSDEEP

      1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQo:OeodiUO4p13b9HiIeoutuh1aQo

    Score
    7/10
    defense_evasiondiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks