Overview

overview

8

Static

static

de96d8ecfd...83.exe

windows7-x64

8

de96d8ecfd...83.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de96d8ecfd0539bfc19a9d721a0f520283efa91e4969751141b770990e79ab83

  • Size

    4.4MB

  • Sample

    221123-p5hmgagb2x

  • MD5

    bebf99d452c84ae6942edb67981dfe7b

  • SHA1

    706ccf3e9fd16462d26b7feb3aaaa9075d416765

  • SHA256

    de96d8ecfd0539bfc19a9d721a0f520283efa91e4969751141b770990e79ab83

  • SHA512

    60da4ccbf63887aa18f576207fcea79a5dedca11afb4a38a0958a3e7fe976d142761f123cd2ffd9bd7177a9c68b2dc85b2044ecb6ddde638e8a535cb851dd9da

  • SSDEEP

    98304:oP8ReGIO335AWrRNoZgo7gnqlNMIHf9k0LNm4ykaJQmJGChdT+r:6MeG335AWVNug6gn6NVm0xEXJQmJhd

Score
8/10
evasionpersistencevmprotect

Malware Config

Targets

    • Target

      de96d8ecfd0539bfc19a9d721a0f520283efa91e4969751141b770990e79ab83

    • Size

      4.4MB

    • MD5

      bebf99d452c84ae6942edb67981dfe7b

    • SHA1

      706ccf3e9fd16462d26b7feb3aaaa9075d416765

    • SHA256

      de96d8ecfd0539bfc19a9d721a0f520283efa91e4969751141b770990e79ab83

    • SHA512

      60da4ccbf63887aa18f576207fcea79a5dedca11afb4a38a0958a3e7fe976d142761f123cd2ffd9bd7177a9c68b2dc85b2044ecb6ddde638e8a535cb851dd9da

    • SSDEEP

      98304:oP8ReGIO335AWrRNoZgo7gnqlNMIHf9k0LNm4ykaJQmJGChdT+r:6MeG335AWVNug6gn6NVm0xEXJQmJhd

    Score
    8/10
    evasionpersistencevmprotect

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks