General

  • Target

    vpFeuLfJ.exe

  • Size

    33KB

  • Sample

    201015-64xwy9lv4j

  • MD5

    0613e9a0b44d56f9203f838b07932f84

  • SHA1

    952038465310a43a6741ba20d38e1a0c9d28ead1

  • SHA256

    d607e4cf6254db79c5a50a6e59c25f9387951f545da0b1475719209d8d357f64

  • SHA512

    fb18ab1740d048cfa0b13b051b16f7faf20c6c1a026f526688586fa04aec923f52e198418c8e7b0f024a9a5a3dcc794a44bd14409e7b8f8cfad214286a963d80

Score
8/10

Malware Config

Targets

    • Target

      vpFeuLfJ.exe

    • Size

      33KB

    • MD5

      0613e9a0b44d56f9203f838b07932f84

    • SHA1

      952038465310a43a6741ba20d38e1a0c9d28ead1

    • SHA256

      d607e4cf6254db79c5a50a6e59c25f9387951f545da0b1475719209d8d357f64

    • SHA512

      fb18ab1740d048cfa0b13b051b16f7faf20c6c1a026f526688586fa04aec923f52e198418c8e7b0f024a9a5a3dcc794a44bd14409e7b8f8cfad214286a963d80

    Score
    8/10
    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Tasks