Overview

overview

7

Static

static

5

0227bd079c...dN.exe

windows7-x64

7

0227bd079c...dN.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0227bd079c9bbd108828bb19b75be7db9c7ebf363d3eb39131949269e46028cdN.exe

  • Size

    135KB

  • Sample

    241203-wcyasawmaz

  • MD5

    a250ae6b971bfde739130710a2a41ca0

  • SHA1

    25e5fbbc36ff71c38635cd27b95a0dc902ca1bd4

  • SHA256

    0227bd079c9bbd108828bb19b75be7db9c7ebf363d3eb39131949269e46028cd

  • SHA512

    ffc73e72a52064cc3f1c8695f0bd9dd9713048acc38a5020469f735da9c1c351aa0194e553858935e903a131f1f78199e369b3a2ecd3eec674f87b15991bfb1a

  • SSDEEP

    1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOIS:YfU/WF6QMauSuiWNi9eNOl0007NZIOj

Score
7/10
defense_evasiondiscoverypersistenceupx

Malware Config

Targets

    • Target

      0227bd079c9bbd108828bb19b75be7db9c7ebf363d3eb39131949269e46028cdN.exe

    • Size

      135KB

    • MD5

      a250ae6b971bfde739130710a2a41ca0

    • SHA1

      25e5fbbc36ff71c38635cd27b95a0dc902ca1bd4

    • SHA256

      0227bd079c9bbd108828bb19b75be7db9c7ebf363d3eb39131949269e46028cd

    • SHA512

      ffc73e72a52064cc3f1c8695f0bd9dd9713048acc38a5020469f735da9c1c351aa0194e553858935e903a131f1f78199e369b3a2ecd3eec674f87b15991bfb1a

    • SSDEEP

      1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOIS:YfU/WF6QMauSuiWNi9eNOl0007NZIOj

    Score
    7/10
    defense_evasiondiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks