Overview

overview

9

Static

static

9

10b8de5496...16.msi

windows7_x64

8

10b8de5496...16.msi

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10b8de549614240e9f6bcdbd5ac7b9a407760d9a882c8bb6a3e2cb978f0aa916.msi

  • Size

    4.3MB

  • Sample

    211014-fephnagba5

  • MD5

    2922d30afb359edde8083596e20601dc

  • SHA1

    62173f9e19f1dc5c724689d47e57cd6ab8fd7b58

  • SHA256

    10b8de549614240e9f6bcdbd5ac7b9a407760d9a882c8bb6a3e2cb978f0aa916

  • SHA512

    50486320282a54a3aba1d6cd6027524ef8ea25ef9915be515c30381ca26d06c5b2bc69aa9167cf89d00a27abf5fa1716f68d95026683f46c643df6b2cd0ee82c

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      10b8de549614240e9f6bcdbd5ac7b9a407760d9a882c8bb6a3e2cb978f0aa916.msi

    • Size

      4.3MB

    • MD5

      2922d30afb359edde8083596e20601dc

    • SHA1

      62173f9e19f1dc5c724689d47e57cd6ab8fd7b58

    • SHA256

      10b8de549614240e9f6bcdbd5ac7b9a407760d9a882c8bb6a3e2cb978f0aa916

    • SHA512

      50486320282a54a3aba1d6cd6027524ef8ea25ef9915be515c30381ca26d06c5b2bc69aa9167cf89d00a27abf5fa1716f68d95026683f46c643df6b2cd0ee82c

    Score
    8/10
    discoveryevasion

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

Peripheral Device Discovery

2
T1120

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks