Overview

overview

8

Static

static

tmp.exe

windows7-x64

8

tmp.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1.4MB

  • Sample

    221016-1yy7esacfq

  • MD5

    655012dcdb5df1cd60e387380f381221

  • SHA1

    4865ffd6b51346d8b526e06e752ed7703d29d9fd

  • SHA256

    abad86c13adb02a2eba9d9b18deb3c88a3d4b2d8970202b8a922f49d2aeebb7c

  • SHA512

    6303f8b76714bff8f51364cd10850d9a55458d350d873813988afc239dcf2de1eb49dd58ac3547255213d9aba0eb1a99ae35b1c70bbc4bc3f9bdbf16ec88b1e5

  • SSDEEP

    24576:82G/nvxW3WdmIuYugMtuLJJvzCnKUJwY6rMwBiybDyUCLy70r/C3nAztll:8bA3lIuYugcuLJJvzIZN6r9Rvyjy0r/r

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      tmp

    • Size

      1.4MB

    • MD5

      655012dcdb5df1cd60e387380f381221

    • SHA1

      4865ffd6b51346d8b526e06e752ed7703d29d9fd

    • SHA256

      abad86c13adb02a2eba9d9b18deb3c88a3d4b2d8970202b8a922f49d2aeebb7c

    • SHA512

      6303f8b76714bff8f51364cd10850d9a55458d350d873813988afc239dcf2de1eb49dd58ac3547255213d9aba0eb1a99ae35b1c70bbc4bc3f9bdbf16ec88b1e5

    • SSDEEP

      24576:82G/nvxW3WdmIuYugMtuLJJvzCnKUJwY6rMwBiybDyUCLy70r/C3nAztll:8bA3lIuYugcuLJJvzIZN6r9Rvyjy0r/r

    Score
    8/10
    vmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks