Overview

overview

8

Static

static

1

817ef1bfeb...20.exe

windows7-x64

8

817ef1bfeb...20.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    817ef1bfebff3908fd10700b5702a0cfdeba4ebe01679abaed00916bd534b120

  • Size

    76KB

  • Sample

    220919-a4zf9sdcbm

  • MD5

    93500f450414bf2a5d23f125ae836d88

  • SHA1

    d675de5d9814b4515a94254b7abe26d2951c145d

  • SHA256

    817ef1bfebff3908fd10700b5702a0cfdeba4ebe01679abaed00916bd534b120

  • SHA512

    39318f55a28306178e8ce1626d3aaaf30453dbaba422f65e49eb4adcb92ad367d7dbe25dd92ca234a2f5083c02a2a2f6eb4dac8f7de2e4a79d02fc08abd71348

  • SSDEEP

    1536:KAhTyTTFQNC13U4rtnDb4tmJlyAX5pKTFHFEqTYFUIvqPno0dYgT4I3m:XhT2137DYmJlyAXc8FGPnfiG3m

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      817ef1bfebff3908fd10700b5702a0cfdeba4ebe01679abaed00916bd534b120

    • Size

      76KB

    • MD5

      93500f450414bf2a5d23f125ae836d88

    • SHA1

      d675de5d9814b4515a94254b7abe26d2951c145d

    • SHA256

      817ef1bfebff3908fd10700b5702a0cfdeba4ebe01679abaed00916bd534b120

    • SHA512

      39318f55a28306178e8ce1626d3aaaf30453dbaba422f65e49eb4adcb92ad367d7dbe25dd92ca234a2f5083c02a2a2f6eb4dac8f7de2e4a79d02fc08abd71348

    • SSDEEP

      1536:KAhTyTTFQNC13U4rtnDb4tmJlyAX5pKTFHFEqTYFUIvqPno0dYgT4I3m:XhT2137DYmJlyAXc8FGPnfiG3m

    Score
    8/10
    persistencevmprotect

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks