Overview

overview

7

Static

static

5

68449866e9...fd.exe

windows7-x64

7

68449866e9...fd.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68449866e9c6cec2bb5473dbc02053ecf6222b1c9e631c77daae1e9e72c80efd.exe

  • Size

    59KB

  • Sample

    241123-lav3jaymhp

  • MD5

    260e016e3047c3206db612987cbfcbbf

  • SHA1

    942505de7aa7ac70e1627b9848e0d7d6e9e73621

  • SHA256

    68449866e9c6cec2bb5473dbc02053ecf6222b1c9e631c77daae1e9e72c80efd

  • SHA512

    8ee58de727ff11f4ebe92ec8091f8a877b789438a08774206f3dd640270e31a5e9d4e4d019bc64e942f3353caa7c08017535b295cc4d17703067c406e2cbb5e4

  • SSDEEP

    1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQx:OeodiUO4p13b9HiIeoutuh1aQx

Score
7/10
defense_evasiondiscoverypersistenceupx

Malware Config

Targets

    • Target

      68449866e9c6cec2bb5473dbc02053ecf6222b1c9e631c77daae1e9e72c80efd.exe

    • Size

      59KB

    • MD5

      260e016e3047c3206db612987cbfcbbf

    • SHA1

      942505de7aa7ac70e1627b9848e0d7d6e9e73621

    • SHA256

      68449866e9c6cec2bb5473dbc02053ecf6222b1c9e631c77daae1e9e72c80efd

    • SHA512

      8ee58de727ff11f4ebe92ec8091f8a877b789438a08774206f3dd640270e31a5e9d4e4d019bc64e942f3353caa7c08017535b295cc4d17703067c406e2cbb5e4

    • SSDEEP

      1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQx:OeodiUO4p13b9HiIeoutuh1aQx

    Score
    7/10
    defense_evasiondiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks