Overview

overview

9

Static

static

c192d040bc...in.exe

windows7_x64

9

c192d040bc...in.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c192d040bcbc2c2e77698410a3f9ad1caf2b9d2a4842b4a16eb09f3446493a9c.bin

  • Size

    915KB

  • Sample

    200725-1lpqcwqrfn

  • MD5

    76d274c823439cf02f18a0deccfe70c5

  • SHA1

    1cd7cd1fc0f7890da57af806e67061d2022abcd4

  • SHA256

    af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a

  • SHA512

    a094877fd2fe166517446eeb2134268fedfeaacba20cd7b964adf7f34affba675fa598c4f9d2689342e07d2bcd8a0e08d2f11202cfd00abffea679bb9d300c48

Score
9/10
evasion

Malware Config

Targets

    • Target

      c192d040bcbc2c2e77698410a3f9ad1caf2b9d2a4842b4a16eb09f3446493a9c.bin

    • Size

      915KB

    • MD5

      76d274c823439cf02f18a0deccfe70c5

    • SHA1

      1cd7cd1fc0f7890da57af806e67061d2022abcd4

    • SHA256

      af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a

    • SHA512

      a094877fd2fe166517446eeb2134268fedfeaacba20cd7b964adf7f34affba675fa598c4f9d2689342e07d2bcd8a0e08d2f11202cfd00abffea679bb9d300c48

    Score
    9/10
    evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks