Overview

overview

10

Static

static

8

e710b6e8b6...18.exe

windows7_x64

10

e710b6e8b6...18.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e710b6e8b67081bfcacad4322af05f18

  • Size

    9.8MB

  • Sample

    211202-ne23raaea9

  • MD5

    e710b6e8b67081bfcacad4322af05f18

  • SHA1

    c63c105b5dba31f71c8cd1ad848e6e803c62b788

  • SHA256

    257d72c3d89409e5e2ee39c6005312c50d0beab11db7cade24f8cdaeba7938dc

  • SHA512

    98bd5838b563f0e964474a11e09cc668f2cb08e03ab9993c5021b61b8e1753c355dc97105475a5a53c82d0c214fb4e6906434f97b0b9cb3192ea1030f7761eb9

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      e710b6e8b67081bfcacad4322af05f18

    • Size

      9.8MB

    • MD5

      e710b6e8b67081bfcacad4322af05f18

    • SHA1

      c63c105b5dba31f71c8cd1ad848e6e803c62b788

    • SHA256

      257d72c3d89409e5e2ee39c6005312c50d0beab11db7cade24f8cdaeba7938dc

    • SHA512

      98bd5838b563f0e964474a11e09cc668f2cb08e03ab9993c5021b61b8e1753c355dc97105475a5a53c82d0c214fb4e6906434f97b0b9cb3192ea1030f7761eb9

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks