Overview

overview

8

Static

static

8

393fca25fa...f8.exe

windows7-x64

8

393fca25fa...f8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    393fca25fa54037766be5b07e99034c37b30fad9ed06403e78d31652e2be51f8

  • Size

    183KB

  • Sample

    221002-q3y24sahbp

  • MD5

    647b2fbfcfb6d6d09c803407c10fa2b0

  • SHA1

    df87876d54b897b67dc0a717f29ddb4381a01846

  • SHA256

    393fca25fa54037766be5b07e99034c37b30fad9ed06403e78d31652e2be51f8

  • SHA512

    cbe7a599f4dab2e56d34f4e7daa40c8ab52be0315553beb010bc26bf705bcba7a97d729b8e816c841fa0b5138269f0cd313a2efe0990fcb871391c0c5556e2b6

  • SSDEEP

    3072:ApNKF5N9lKfdIzuuL0Pe31wRqZexd1rYVtFMfbJKBMCSFKZmcbAvDsat7nUtwROD:ApNKLNzKfauRRq4YVtyJqMCS8ZBgDsa0

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      393fca25fa54037766be5b07e99034c37b30fad9ed06403e78d31652e2be51f8

    • Size

      183KB

    • MD5

      647b2fbfcfb6d6d09c803407c10fa2b0

    • SHA1

      df87876d54b897b67dc0a717f29ddb4381a01846

    • SHA256

      393fca25fa54037766be5b07e99034c37b30fad9ed06403e78d31652e2be51f8

    • SHA512

      cbe7a599f4dab2e56d34f4e7daa40c8ab52be0315553beb010bc26bf705bcba7a97d729b8e816c841fa0b5138269f0cd313a2efe0990fcb871391c0c5556e2b6

    • SSDEEP

      3072:ApNKF5N9lKfdIzuuL0Pe31wRqZexd1rYVtFMfbJKBMCSFKZmcbAvDsat7nUtwROD:ApNKLNzKfauRRq4YVtyJqMCS8ZBgDsa0

    Score
    8/10
    discoverypersistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks