Overview

overview

8

Static

static

236eb4b6c7...ac.exe

windows7-x64

8

236eb4b6c7...ac.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    236eb4b6c7cc5e270e4540f23c78a255b502f78c5f19fed1c476963935e816ac

  • Size

    975KB

  • Sample

    221123-r5t2lsdd7y

  • MD5

    5847b9ede173b9906cd97d16d8f439ae

  • SHA1

    252e1ef6da885fdd3b730ac7d37d3f062aed9b69

  • SHA256

    236eb4b6c7cc5e270e4540f23c78a255b502f78c5f19fed1c476963935e816ac

  • SHA512

    49caf512a6b6c07a0f949dc45eb8b803658ce5f98c0b0382468dd1fe5372a19d69eeff0bf7a488f4f91f8334342b1f5f45a342394c4450ed24d619b34c7615c1

  • SSDEEP

    6144:aZ7l+qrvVra1h+9tbZ8WyAJe/V0TUJp9497AXJRpte6ECZkgwTSkne8CpiKk:cro1s9tWmetKw9qsHptemz7kne8CY

Score
8/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      236eb4b6c7cc5e270e4540f23c78a255b502f78c5f19fed1c476963935e816ac

    • Size

      975KB

    • MD5

      5847b9ede173b9906cd97d16d8f439ae

    • SHA1

      252e1ef6da885fdd3b730ac7d37d3f062aed9b69

    • SHA256

      236eb4b6c7cc5e270e4540f23c78a255b502f78c5f19fed1c476963935e816ac

    • SHA512

      49caf512a6b6c07a0f949dc45eb8b803658ce5f98c0b0382468dd1fe5372a19d69eeff0bf7a488f4f91f8334342b1f5f45a342394c4450ed24d619b34c7615c1

    • SSDEEP

      6144:aZ7l+qrvVra1h+9tbZ8WyAJe/V0TUJp9497AXJRpte6ECZkgwTSkne8CpiKk:cro1s9tWmetKw9qsHptemz7kne8CY

    Score
    8/10
    discoveryevasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks