Overview

overview

8

Static

static

da90aebcc0...40.exe

windows7-x64

8

da90aebcc0...40.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da90aebcc0d981ed6c0f5a0c031751b0858f7b4accd571ac2acdfc7b496d9740

  • Size

    4.8MB

  • Sample

    221125-3nvglaac41

  • MD5

    52892e52a02453b4b4c19243aa2d6ac7

  • SHA1

    d1ad866e6ca77d3fbe7252db58528240f7c444db

  • SHA256

    da90aebcc0d981ed6c0f5a0c031751b0858f7b4accd571ac2acdfc7b496d9740

  • SHA512

    16c15f63c585a459b3e83482e4171fe5b86a8bd6e142636618b7f2240d47fd59813abb44f2bec59735f7711b8b8cc02e14a9eca7d0a4a2f339f158244b24716b

  • SSDEEP

    98304:Pcj2HBOSbXcjxJyKFnbU2rsygBuyz0ANbXBdijekvX4jtfKillblA7CjmiU/F7KY:kaEaXWYUnA2rsNLWPX4Bv0CmiU92w

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      da90aebcc0d981ed6c0f5a0c031751b0858f7b4accd571ac2acdfc7b496d9740

    • Size

      4.8MB

    • MD5

      52892e52a02453b4b4c19243aa2d6ac7

    • SHA1

      d1ad866e6ca77d3fbe7252db58528240f7c444db

    • SHA256

      da90aebcc0d981ed6c0f5a0c031751b0858f7b4accd571ac2acdfc7b496d9740

    • SHA512

      16c15f63c585a459b3e83482e4171fe5b86a8bd6e142636618b7f2240d47fd59813abb44f2bec59735f7711b8b8cc02e14a9eca7d0a4a2f339f158244b24716b

    • SSDEEP

      98304:Pcj2HBOSbXcjxJyKFnbU2rsygBuyz0ANbXBdijekvX4jtfKillblA7CjmiU/F7KY:kaEaXWYUnA2rsNLWPX4Bv0CmiU92w

    Score
    8/10
    persistencevmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks