Overview

overview

8

Static

static

8

bbe9d72b94...2f.exe

windows7-x64

8

bbe9d72b94...2f.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbe9d72b945a40d1697f1a140bc2428f3e5fd92d574f4cd11ef5f785ec0b452f

  • Size

    28KB

  • Sample

    221124-qy748agd24

  • MD5

    d23e18e8803bf90e5170e2af9c706aae

  • SHA1

    c9b8cdac25f867831a124eb1a86356b773de1d8a

  • SHA256

    bbe9d72b945a40d1697f1a140bc2428f3e5fd92d574f4cd11ef5f785ec0b452f

  • SHA512

    788aa97737c2eddf8258113f6a3351c2b12959c4a02e7c5162f075a12718a43cadc4a8483b42811904bc87aed36561628fa9ad8710df59da3b353461facca6d6

  • SSDEEP

    384:nSuZdU1AAziEyXDWAwVgLqVHp2YtjupdT8Fj0eohDTkVOhvF27z/2z:nLj8iEEQiqVHUYkpNWC9yoYf

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      bbe9d72b945a40d1697f1a140bc2428f3e5fd92d574f4cd11ef5f785ec0b452f

    • Size

      28KB

    • MD5

      d23e18e8803bf90e5170e2af9c706aae

    • SHA1

      c9b8cdac25f867831a124eb1a86356b773de1d8a

    • SHA256

      bbe9d72b945a40d1697f1a140bc2428f3e5fd92d574f4cd11ef5f785ec0b452f

    • SHA512

      788aa97737c2eddf8258113f6a3351c2b12959c4a02e7c5162f075a12718a43cadc4a8483b42811904bc87aed36561628fa9ad8710df59da3b353461facca6d6

    • SSDEEP

      384:nSuZdU1AAziEyXDWAwVgLqVHp2YtjupdT8Fj0eohDTkVOhvF27z/2z:nLj8iEEQiqVHUYkpNWC9yoYf

    Score
    8/10
    discoverypersistenceupx

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks