eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6 | Triage

Submit
Reports

Overview

overview

Static

static

5

eb4632bcaf...f6.exe

windows7-x64

eb4632bcaf...f6.exe

windows10-2004-x64

Sharing

General

Target

eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6
Size

1.7MB
Sample

241130-fy9ypstrfy
MD5

6f7b8480a4cb654f4f7c752711d47ffd
SHA1

0d2c246bbbd8cb7d838a9d1bd77bd0c4ad0b9728
SHA256

eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6
SHA512

0ec8a0b4339a42284c9e17258982033f1673697005d98a888eb5fdd2bd269a16c980d49063bb0814579f6205fe1fd14206d3025e66fef1c528a5a9dd01393146
SSDEEP

12288:Y6sg9q8utL6R91NNaUfViptH0D9wvT1xkZTWbq6Pknm2N5kv7Z62J5ugQ8cY47OO:YyG6RGjv7biFpVUu

Score

10^/10

discovery evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6.exe

Resource

win7-20241010-en

discovery evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6.exe

Resource

win10v2004-20241007-en

discovery evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6
- Size
  
  1.7MB
- MD5
  
  6f7b8480a4cb654f4f7c752711d47ffd
- SHA1
  
  0d2c246bbbd8cb7d838a9d1bd77bd0c4ad0b9728
- SHA256
  
  eb4632bcaf56a47ec25919767657f725cc0e9688c30478b81f49498b4125a5f6
- SHA512
  
  0ec8a0b4339a42284c9e17258982033f1673697005d98a888eb5fdd2bd269a16c980d49063bb0814579f6205fe1fd14206d3025e66fef1c528a5a9dd01393146
- SSDEEP
  
  12288:Y6sg9q8utL6R91NNaUfViptH0D9wvT1xkZTWbq6Pknm2N5kv7Z62J5ugQ8cY47OO:YyG6RGjv7biFpVUu
Score

10^/10

discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx

© 2018-2024

Terms | Privacy