Overview

overview

8

Static

static

8

8e627841ba...56.exe

windows7-x64

8

8e627841ba...56.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156

  • Size

    832KB

  • Sample

    221123-lqfmsaca28

  • MD5

    1fdb8732b0bbc5fd328f9624cd6bb637

  • SHA1

    42a62647664a1834d81e40fb3ad2b758c2f4565f

  • SHA256

    8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156

  • SHA512

    096765fb4b0d3c6b87b5ab91d4f6e5219fa9a4a2575ba2ab34f4eeee6fe54832e42189376c1b962276aeeb5e5fc2e68dbaee28b9906be0490ff16a820a07800d

  • SSDEEP

    24576:othEVaPqL0dPizldLFvusj24sDVdzvTud:MEVUcmiz1C45

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156

    • Size

      832KB

    • MD5

      1fdb8732b0bbc5fd328f9624cd6bb637

    • SHA1

      42a62647664a1834d81e40fb3ad2b758c2f4565f

    • SHA256

      8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156

    • SHA512

      096765fb4b0d3c6b87b5ab91d4f6e5219fa9a4a2575ba2ab34f4eeee6fe54832e42189376c1b962276aeeb5e5fc2e68dbaee28b9906be0490ff16a820a07800d

    • SSDEEP

      24576:othEVaPqL0dPizldLFvusj24sDVdzvTud:MEVUcmiz1C45

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks