Overview

overview

10

Static

static

SecuriteIn...55.exe

windows7_x64

10

SecuriteIn...55.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Bulz.371365.8514.2555

  • Size

    4.6MB

  • Sample

    210306-d4llf4b9qn

  • MD5

    d6f9cf363d1cdbf8c076f9198e19df01

  • SHA1

    b70fe14eef9aa33bd33068514e192f259802c5f1

  • SHA256

    6f7c097945c1602bbae27e4664004cf2139e66226f54b9499df311bdab804ebb

  • SHA512

    373962c1533835c6b490310a3a7ae99d6cca22359017499dc9c607a2a06c373a34b55d2ac472c85596f76ac233e87f530ff21cd2b80b916554fbbf6fb7cee1a7

Score
10/10
discoveryexploitpersistenceupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Targets

    • Target

      SecuriteInfo.com.Variant.Bulz.371365.8514.2555

    • Size

      4.6MB

    • MD5

      d6f9cf363d1cdbf8c076f9198e19df01

    • SHA1

      b70fe14eef9aa33bd33068514e192f259802c5f1

    • SHA256

      6f7c097945c1602bbae27e4664004cf2139e66226f54b9499df311bdab804ebb

    • SHA512

      373962c1533835c6b490310a3a7ae99d6cca22359017499dc9c607a2a06c373a34b55d2ac472c85596f76ac233e87f530ff21cd2b80b916554fbbf6fb7cee1a7

    Score
    10/10
    discoveryexploitpersistenceupx

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blocklisted process makes network request

    • Modifies RDP port number used by Windows

    • Possible privilege escalation attempt

      exploit

    • Sets DLL path for service in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1
T1076

Collection

Exfiltration

Command and Control

Impact

Tasks