Overview

overview

8

Static

static

8

dc54f2c3c2...61.exe

windows7-x64

8

dc54f2c3c2...61.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc54f2c3c2e7ad848241125c272e202ce462e63338032fb3bf4c8868fb073a61

  • Size

    1.3MB

  • Sample

    221124-mtqslaha93

  • MD5

    92aafe7bcf2ab2d498314abd5fb50aa6

  • SHA1

    dc03663d65231fe80cac1d94025f2e2d577f1bd8

  • SHA256

    dc54f2c3c2e7ad848241125c272e202ce462e63338032fb3bf4c8868fb073a61

  • SHA512

    295d4d0c9e8b2e36cbbadb449fb25e1889870ac8855473645ebec67b40c21d7b9f630be93f454ac5adb88620bf1aa5d0d809448da29fdd8f15c195bcda3fed7b

  • SSDEEP

    24576:cEIcw9lUgrG+6s7rWB+OmPomKGyg5k0UvVMHLV:TakgC+zrWB+VFjruw

Score
8/10
vmprotect

Malware Config

Targets

    • Target

      dc54f2c3c2e7ad848241125c272e202ce462e63338032fb3bf4c8868fb073a61

    • Size

      1.3MB

    • MD5

      92aafe7bcf2ab2d498314abd5fb50aa6

    • SHA1

      dc03663d65231fe80cac1d94025f2e2d577f1bd8

    • SHA256

      dc54f2c3c2e7ad848241125c272e202ce462e63338032fb3bf4c8868fb073a61

    • SHA512

      295d4d0c9e8b2e36cbbadb449fb25e1889870ac8855473645ebec67b40c21d7b9f630be93f454ac5adb88620bf1aa5d0d809448da29fdd8f15c195bcda3fed7b

    • SSDEEP

      24576:cEIcw9lUgrG+6s7rWB+OmPomKGyg5k0UvVMHLV:TakgC+zrWB+VFjruw

    Score
    8/10
    vmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks