Overview

overview

9

Static

static

1

7c60b53153...3c.exe

windows7-x64

9

7c60b53153...3c.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c60b53153e69f26d7a03b076f5267103ceb0afa14dd988beb8d3d62d99a653c

  • Size

    235KB

  • Sample

    221123-m5xqaaba5y

  • MD5

    cd66c798599f2617ebf7408dff6001cc

  • SHA1

    ab4973bf9df5b128db764013a44e581ee4446fa2

  • SHA256

    7c60b53153e69f26d7a03b076f5267103ceb0afa14dd988beb8d3d62d99a653c

  • SHA512

    a957f31d1d40b9a8327f7f4c785116ad175a388fde1c547c957cef5a4efa0cce9f2d80133a34dcde78b8b6f98ede7f881b97b50cf0bf40ed2bbf202dbe98c0a5

  • SSDEEP

    6144:TQqvdQinUjtxDJtrUt3DDbr9cfOMQfduHbVmrki:hd/Updv23NcWJfdwb8rl

Score
9/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      7c60b53153e69f26d7a03b076f5267103ceb0afa14dd988beb8d3d62d99a653c

    • Size

      235KB

    • MD5

      cd66c798599f2617ebf7408dff6001cc

    • SHA1

      ab4973bf9df5b128db764013a44e581ee4446fa2

    • SHA256

      7c60b53153e69f26d7a03b076f5267103ceb0afa14dd988beb8d3d62d99a653c

    • SHA512

      a957f31d1d40b9a8327f7f4c785116ad175a388fde1c547c957cef5a4efa0cce9f2d80133a34dcde78b8b6f98ede7f881b97b50cf0bf40ed2bbf202dbe98c0a5

    • SSDEEP

      6144:TQqvdQinUjtxDJtrUt3DDbr9cfOMQfduHbVmrki:hd/Updv23NcWJfdwb8rl

    Score
    9/10
    evasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks