Overview

overview

10

Static

static

10

9KAWN_Built.exe

windows7-x64

7

9KAWN_Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9KAWN_Built.exe

  • Size

    6.0MB

  • Sample

    241102-wl692s1erc

  • MD5

    bbac0a0ed3093eeff69b3e2cb0c046dc

  • SHA1

    07f5465ec9f0586e273e6f121274a12dd3703c08

  • SHA256

    ba6ab33a11849d2e9603dae27efdedf314c134a5da00e463fdb456d2eb9aef3b

  • SHA512

    9de05a9079ffaf1e546c550e70500625f89be5a4a0f15eb9d331fae7de4ebf652c91567c1d5cb86767cd609160b44587e9d8e24499da0ef3148c630d91c03cbd

  • SSDEEP

    98304:SQEtdFBCIAr6amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RpOLP4y+Eyk:SXFIIgTeN/FJMIDJf0gsAGK4R8LP4R3k

Score
10/10
blankgrabberexecutionupx

Malware Config

Targets

    • Target

      9KAWN_Built.exe

    • Size

      6.0MB

    • MD5

      bbac0a0ed3093eeff69b3e2cb0c046dc

    • SHA1

      07f5465ec9f0586e273e6f121274a12dd3703c08

    • SHA256

      ba6ab33a11849d2e9603dae27efdedf314c134a5da00e463fdb456d2eb9aef3b

    • SHA512

      9de05a9079ffaf1e546c550e70500625f89be5a4a0f15eb9d331fae7de4ebf652c91567c1d5cb86767cd609160b44587e9d8e24499da0ef3148c630d91c03cbd

    • SSDEEP

      98304:SQEtdFBCIAr6amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RpOLP4y+Eyk:SXFIIgTeN/FJMIDJf0gsAGK4R8LP4R3k

    Score
    8/10
    upxexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks