Overview

overview

8

Static

static

8

6ec3141a5e...f9.exe

windows7_x64

8

6ec3141a5e...f9.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ec3141a5eef6fc33126818ea4a1dec85358523854a5467543d87e029773d5f9

  • Size

    5.0MB

  • Sample

    210228-jrfel1h4he

  • MD5

    25c689e345e4f8112008edeeb50e5b54

  • SHA1

    bd714c54c874280963f49d9c9b0965afb676368b

  • SHA256

    6ec3141a5eef6fc33126818ea4a1dec85358523854a5467543d87e029773d5f9

  • SHA512

    acd526c5ba60d43672963dceac8ab151d1e74f3f46180b2f5fbb7be377b7a1aba0ce8116e3f4b93f7beab33d265bdf210335b407d4fd5f1c09c6141a4be621fc

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      6ec3141a5eef6fc33126818ea4a1dec85358523854a5467543d87e029773d5f9

    • Size

      5.0MB

    • MD5

      25c689e345e4f8112008edeeb50e5b54

    • SHA1

      bd714c54c874280963f49d9c9b0965afb676368b

    • SHA256

      6ec3141a5eef6fc33126818ea4a1dec85358523854a5467543d87e029773d5f9

    • SHA512

      acd526c5ba60d43672963dceac8ab151d1e74f3f46180b2f5fbb7be377b7a1aba0ce8116e3f4b93f7beab33d265bdf210335b407d4fd5f1c09c6141a4be621fc

    Score
    8/10

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks