Overview

overview

8

Static

static

e382e84e93...20.exe

windows7-x64

8

e382e84e93...20.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e382e84e93e664ca59dff417783b4d6590d6e99c6dec501deccffbb1e71a1820

  • Size

    15.6MB

  • Sample

    221125-k1cs7sae5z

  • MD5

    0cc7fce781f29893024c4ee445af66f8

  • SHA1

    ac1815eda9243e64495f08128608b6a4315f0ea1

  • SHA256

    e382e84e93e664ca59dff417783b4d6590d6e99c6dec501deccffbb1e71a1820

  • SHA512

    6e57a9261d2231a00400d4246fb49ee559b2151c4b730b85ef4758592f9a3d1f28367e6d6fea51ad3b271cf0b5747c4b4a8cf9885406d94c99597a79dd17c78a

  • SSDEEP

    393216:iFmqhSX06HF3RUI2eg+uLd2dW4yI/QpCUOX:WFME6HNKI2SuLIdW4yI/QUUOX

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      e382e84e93e664ca59dff417783b4d6590d6e99c6dec501deccffbb1e71a1820

    • Size

      15.6MB

    • MD5

      0cc7fce781f29893024c4ee445af66f8

    • SHA1

      ac1815eda9243e64495f08128608b6a4315f0ea1

    • SHA256

      e382e84e93e664ca59dff417783b4d6590d6e99c6dec501deccffbb1e71a1820

    • SHA512

      6e57a9261d2231a00400d4246fb49ee559b2151c4b730b85ef4758592f9a3d1f28367e6d6fea51ad3b271cf0b5747c4b4a8cf9885406d94c99597a79dd17c78a

    • SSDEEP

      393216:iFmqhSX06HF3RUI2eg+uLd2dW4yI/QpCUOX:WFME6HNKI2SuLIdW4yI/QUUOX

    Score
    8/10
    vmprotectpersistence

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks