Overview

overview

8

Static

static

41981eae53...9e.exe

windows7-x64

8

41981eae53...9e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41981eae53353a1f4590af0e83aca41541b5baf93f5cb788e70238305ab52d9e

  • Size

    12.3MB

  • Sample

    221125-lspcpsgg79

  • MD5

    eaa2ff49df45df92323c36a248de7ba5

  • SHA1

    d13d7a9dd31a3392f0412ba2604044baab50f940

  • SHA256

    41981eae53353a1f4590af0e83aca41541b5baf93f5cb788e70238305ab52d9e

  • SHA512

    bd93ba16661175f47d1dd8d66e34bd4141cb1a7be0c3ed3e63769de6386a834dde260ce420718532f395caed14274503517b1a59e33bac69827e0c24ecf6a0b0

  • SSDEEP

    393216:uiC/KFfDhofMsIEY02VnBu94Wryc/Q6V:T9fstF2VnBu94W20PV

Score
8/10
evasionpersistencevmprotect

Malware Config

Targets

    • Target

      41981eae53353a1f4590af0e83aca41541b5baf93f5cb788e70238305ab52d9e

    • Size

      12.3MB

    • MD5

      eaa2ff49df45df92323c36a248de7ba5

    • SHA1

      d13d7a9dd31a3392f0412ba2604044baab50f940

    • SHA256

      41981eae53353a1f4590af0e83aca41541b5baf93f5cb788e70238305ab52d9e

    • SHA512

      bd93ba16661175f47d1dd8d66e34bd4141cb1a7be0c3ed3e63769de6386a834dde260ce420718532f395caed14274503517b1a59e33bac69827e0c24ecf6a0b0

    • SSDEEP

      393216:uiC/KFfDhofMsIEY02VnBu94Wryc/Q6V:T9fstF2VnBu94W20PV

    Score
    8/10
    evasionpersistencevmprotect

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks