2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68 | Triage

Sharing

General

Target

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68
Size

345KB
Sample

221123-r2rgbadb3z
MD5

44b3c44d1d315d26311e932208b1c976
SHA1

568b085e4f77486f8d50541dfccaef245b859e5b
SHA256

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68
SHA512

0ab303109069471bf8a3738302ff7d3a12f3613e5331af65daa09c3bcdf3d3263bb3751843ee64f078184396770a45243ecbc9ab0b0fcc76f09bd48fb5a1c7b0
SSDEEP

6144:ZSvUox59653OwQ8MbEscrNMYopzSv1LuPS2a5z9ow5kvOHgnavqfFKHxmKXqp/Ws:ZSPceNdANM/18JMaMw5wOHgavEFKRVe9

Score

8^/10

evasion persistence upx

Malware Config

Targets

- Target
  
  2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68
- Size
  
  345KB
- MD5
  
  44b3c44d1d315d26311e932208b1c976
- SHA1
  
  568b085e4f77486f8d50541dfccaef245b859e5b
- SHA256
  
  2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68
- SHA512
  
  0ab303109069471bf8a3738302ff7d3a12f3613e5331af65daa09c3bcdf3d3263bb3751843ee64f078184396770a45243ecbc9ab0b0fcc76f09bd48fb5a1c7b0
- SSDEEP
  
  6144:ZSvUox59653OwQ8MbEscrNMYopzSv1LuPS2a5z9ow5kvOHgnavqfFKHxmKXqp/Ws:ZSPceNdANM/18JMaMw5wOHgavEFKRVe9
Score

8^/10

evasion persistence upx
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx