Overview

overview

8

Static

static

7275527161...c9.exe

windows7-x64

8

7275527161...c9.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7275527161e158dfeaf9dd744bba65bb9de548616d7f34457c6aa1b4969bacc9.exe

  • Size

    115KB

  • Sample

    221123-h4cw9sac71

  • MD5

    5abe44351d425458a0b1aa5c6a2d007c

  • SHA1

    1cf91938b5d6a1d49531d07fc4d0612b4ce18365

  • SHA256

    7275527161e158dfeaf9dd744bba65bb9de548616d7f34457c6aa1b4969bacc9

  • SHA512

    557b0e9a6cca7a33284a463075b2c5e8198e8e489307fceebd3c43d461b0f3447856325b8aa82c1b62d93328cf435baae9fcee124a9d537fca02be9edad2b291

  • SSDEEP

    3072:mU143UTXqhlYDnU/+FKwvmR7Iq2+YlbWa3rdWuLqfUl:5XqfEswv82ZLqfU

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      7275527161e158dfeaf9dd744bba65bb9de548616d7f34457c6aa1b4969bacc9.exe

    • Size

      115KB

    • MD5

      5abe44351d425458a0b1aa5c6a2d007c

    • SHA1

      1cf91938b5d6a1d49531d07fc4d0612b4ce18365

    • SHA256

      7275527161e158dfeaf9dd744bba65bb9de548616d7f34457c6aa1b4969bacc9

    • SHA512

      557b0e9a6cca7a33284a463075b2c5e8198e8e489307fceebd3c43d461b0f3447856325b8aa82c1b62d93328cf435baae9fcee124a9d537fca02be9edad2b291

    • SSDEEP

      3072:mU143UTXqhlYDnU/+FKwvmR7Iq2+YlbWa3rdWuLqfUl:5XqfEswv82ZLqfU

    Score
    8/10
    persistencevmprotect

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks