Overview

overview

10

Static

static

8

401024b77a...16.exe

windows7-x64

10

401024b77a...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    401024b77a10a777700ac9b74cf49ac5d0e5f0de6d78fa18a8ef9cd6e893ed16

  • Size

    45KB

  • Sample

    221120-qdmmsahf4x

  • MD5

    0825a8dc788a065f6c83bac0198704a3

  • SHA1

    c5e6eb4acee804a0ae1e3a0cdbb4d40dc5f7d736

  • SHA256

    401024b77a10a777700ac9b74cf49ac5d0e5f0de6d78fa18a8ef9cd6e893ed16

  • SHA512

    d98ac956c651a1a95c96f35bc4fcb4e44e22ef8ec716559cd951c5255169ee7c5dfde5712f43834b965bb5012f18e43984131393f889d026a60c15475479adf6

  • SSDEEP

    768:gAYG+lzc/ujL+yuSElTTrA7e/GMHZHfsOCawygumxmha5:r+9+yVWTI7eDNfsOCVbun

Score
10/10
aspackv2evasionpersistence

Malware Config

Targets

    • Target

      401024b77a10a777700ac9b74cf49ac5d0e5f0de6d78fa18a8ef9cd6e893ed16

    • Size

      45KB

    • MD5

      0825a8dc788a065f6c83bac0198704a3

    • SHA1

      c5e6eb4acee804a0ae1e3a0cdbb4d40dc5f7d736

    • SHA256

      401024b77a10a777700ac9b74cf49ac5d0e5f0de6d78fa18a8ef9cd6e893ed16

    • SHA512

      d98ac956c651a1a95c96f35bc4fcb4e44e22ef8ec716559cd951c5255169ee7c5dfde5712f43834b965bb5012f18e43984131393f889d026a60c15475479adf6

    • SSDEEP

      768:gAYG+lzc/ujL+yuSElTTrA7e/GMHZHfsOCawygumxmha5:r+9+yVWTI7eDNfsOCVbun

    Score
    10/10
    aspackv2evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks