Overview

overview

8

Static

static

0c2e3dd99e...02.exe

windows7-x64

8

0c2e3dd99e...02.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c2e3dd99e5bb866670fc3ce682dd535a8354b2d829f7705feb6cb46d94ff502

  • Size

    708KB

  • Sample

    221003-b1rgxscdcq

  • MD5

    6ebcedec107feee043a0c99e8d6e3be0

  • SHA1

    c98d0fc081566a2d3d8deee60d1c0c8c901a5ac2

  • SHA256

    0c2e3dd99e5bb866670fc3ce682dd535a8354b2d829f7705feb6cb46d94ff502

  • SHA512

    a6eb97e9d330c2a1a7ed0e5064ad07c2c67eb85d9b1d0b5ef5efd4a1298d864ecc87818272ca10a6d04c67362516ee904d6da16c3c7495873595f9749be31e7b

  • SSDEEP

    1536:b30qZVqt2mXA+ns10j2pAAh8JigKdJCRyYCSt6dzwTFOP4:bkqZiXBi2Ji/dkt6dzwTcw

Score
8/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      0c2e3dd99e5bb866670fc3ce682dd535a8354b2d829f7705feb6cb46d94ff502

    • Size

      708KB

    • MD5

      6ebcedec107feee043a0c99e8d6e3be0

    • SHA1

      c98d0fc081566a2d3d8deee60d1c0c8c901a5ac2

    • SHA256

      0c2e3dd99e5bb866670fc3ce682dd535a8354b2d829f7705feb6cb46d94ff502

    • SHA512

      a6eb97e9d330c2a1a7ed0e5064ad07c2c67eb85d9b1d0b5ef5efd4a1298d864ecc87818272ca10a6d04c67362516ee904d6da16c3c7495873595f9749be31e7b

    • SSDEEP

      1536:b30qZVqt2mXA+ns10j2pAAh8JigKdJCRyYCSt6dzwTFOP4:bkqZiXBi2Ji/dkt6dzwTcw

    Score
    8/10
    discoveryevasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks