Overview

overview

9

Static

static

8

71e9c1a51e...a3.exe

windows7-x64

9

71e9c1a51e...a3.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71e9c1a51ee7e920b39ee3a2dd3aedf5c57822ed43d2ef3bdc37f15953e6f4a3

  • Size

    1.2MB

  • Sample

    221125-1qgmeacd2y

  • MD5

    8e8ecc3a41b959eac06b97016e0ce363

  • SHA1

    c3b8e153f250c339aef7e4683a2992738f45e8d8

  • SHA256

    71e9c1a51ee7e920b39ee3a2dd3aedf5c57822ed43d2ef3bdc37f15953e6f4a3

  • SHA512

    7dd786ab69cdcad92dc70f5759fa7183f5b61fe253b9e46ff4fdbd9a1e6d4b3ed1f2e95018c533251bc54fcb1650e55ed94b755db065fad11ca99b6d38d77c89

  • SSDEEP

    24576:JaWrjrTzPNQTIrdhCvCgLLM4YqaR19zb/C03eX70Mxddy:gWrjLPNYcC5ENqalzb603c4Idd

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      71e9c1a51ee7e920b39ee3a2dd3aedf5c57822ed43d2ef3bdc37f15953e6f4a3

    • Size

      1.2MB

    • MD5

      8e8ecc3a41b959eac06b97016e0ce363

    • SHA1

      c3b8e153f250c339aef7e4683a2992738f45e8d8

    • SHA256

      71e9c1a51ee7e920b39ee3a2dd3aedf5c57822ed43d2ef3bdc37f15953e6f4a3

    • SHA512

      7dd786ab69cdcad92dc70f5759fa7183f5b61fe253b9e46ff4fdbd9a1e6d4b3ed1f2e95018c533251bc54fcb1650e55ed94b755db065fad11ca99b6d38d77c89

    • SSDEEP

      24576:JaWrjrTzPNQTIrdhCvCgLLM4YqaR19zb/C03eX70Mxddy:gWrjLPNYcC5ENqalzb603c4Idd

    Score
    9/10
    upxpersistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks