Overview

overview

9

Static

static

8

8b98c12462...f3.exe

windows7-x64

9

8b98c12462...f3.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

  • Size

    197KB

  • Sample

    221124-bj42pacd7s

  • MD5

    35a759742c1488915a2d53ee24c72be0

  • SHA1

    3a1788a9aade82d00e75153a03801160b0802362

  • SHA256

    8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

  • SHA512

    e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

  • SSDEEP

    3072:h4XzBf/g79e0lQOqbE3NvlZvXxHMGIe1wPsZvHLpOD/HknnGYu6L0/6+DUV:h4XzZPbE3N9vHce1A8HufsnV0/6+DUV

Score
9/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

    • Size

      197KB

    • MD5

      35a759742c1488915a2d53ee24c72be0

    • SHA1

      3a1788a9aade82d00e75153a03801160b0802362

    • SHA256

      8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

    • SHA512

      e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

    • SSDEEP

      3072:h4XzBf/g79e0lQOqbE3NvlZvXxHMGIe1wPsZvHLpOD/HknnGYu6L0/6+DUV:h4XzZPbE3N9vHce1A8HufsnV0/6+DUV

    Score
    9/10
    evasionpersistencetrojanupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Security Software Discovery

1
T1063

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks