Overview

overview

10

Static

static

a3736e8036...1e.exe

windows7_x64

10

a3736e8036...1e.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3736e8036b25f3b0da484b06b57d0081f2d1ff76c51d805743d28cb8e9fd71e

  • Size

    8.5MB

  • Sample

    220701-dkpphahdep

  • MD5

    3c64e67e668e97022a0e312a4e25124c

  • SHA1

    73e851f280090cf099cea3b21318bcc45b9df52d

  • SHA256

    a3736e8036b25f3b0da484b06b57d0081f2d1ff76c51d805743d28cb8e9fd71e

  • SHA512

    b57fd475215196fd678cd9fe74138e9c418378bc33db8a329f0bc4fb7b3bcdde5f6e5094f3a5d0eca18a81fe8c9c4379489c6ec7500d0a51f9fe7d60175e878b

Score
10/10
evasionsuricata

Malware Config

Targets

    • Target

      a3736e8036b25f3b0da484b06b57d0081f2d1ff76c51d805743d28cb8e9fd71e

    • Size

      8.5MB

    • MD5

      3c64e67e668e97022a0e312a4e25124c

    • SHA1

      73e851f280090cf099cea3b21318bcc45b9df52d

    • SHA256

      a3736e8036b25f3b0da484b06b57d0081f2d1ff76c51d805743d28cb8e9fd71e

    • SHA512

      b57fd475215196fd678cd9fe74138e9c418378bc33db8a329f0bc4fb7b3bcdde5f6e5094f3a5d0eca18a81fe8c9c4379489c6ec7500d0a51f9fe7d60175e878b

    Score
    10/10
    evasionsuricata

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks