Overview

overview

9

Static

static

8

2b8200c069...0e.exe

windows7-x64

9

2b8200c069...0e.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b8200c0696b9bc85bb34978bc298af2c11d15a53962a77de5a6a648c96d960e

  • Size

    2.3MB

  • Sample

    221123-yw1alabc37

  • MD5

    3f2033278fc85e929cdc6cb918ec5f0d

  • SHA1

    28ceb3f58b40a3679291ce7254159a606ffee7fc

  • SHA256

    2b8200c0696b9bc85bb34978bc298af2c11d15a53962a77de5a6a648c96d960e

  • SHA512

    96c51bf7ffdae4b57b23c40b97347df4c8b71d10eae9f7bcd3b6161961017285f6f51cd81177442ad5c288006b29daa828a11ecf8b5355e0972bf4dc178a6694

  • SSDEEP

    49152:/h/051wXEqdwk0cQHGiYYSzSY5voVU7zQY:pM51wXEqdwkLQHHhsSYt8

Score
9/10
upxvmprotect

Malware Config

Targets

    • Target

      2b8200c0696b9bc85bb34978bc298af2c11d15a53962a77de5a6a648c96d960e

    • Size

      2.3MB

    • MD5

      3f2033278fc85e929cdc6cb918ec5f0d

    • SHA1

      28ceb3f58b40a3679291ce7254159a606ffee7fc

    • SHA256

      2b8200c0696b9bc85bb34978bc298af2c11d15a53962a77de5a6a648c96d960e

    • SHA512

      96c51bf7ffdae4b57b23c40b97347df4c8b71d10eae9f7bcd3b6161961017285f6f51cd81177442ad5c288006b29daa828a11ecf8b5355e0972bf4dc178a6694

    • SSDEEP

      49152:/h/051wXEqdwk0cQHGiYYSzSY5voVU7zQY:pM51wXEqdwkLQHHhsSYt8

    Score
    9/10
    upxvmprotect

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks