Overview

overview

8

Static

static

8

e0f72c2311...ef.exe

windows7-x64

8

e0f72c2311...ef.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0f72c2311c065288f47277e1961a09616f36a6daeb2256444c8dd3a2c8742ef

  • Size

    122KB

  • Sample

    221126-jfm8rsfe3s

  • MD5

    2ffb189d0cbd907b95ca1f5a202a5f41

  • SHA1

    0b1e4239ab33878ca6aafaed4787ad22142907b7

  • SHA256

    e0f72c2311c065288f47277e1961a09616f36a6daeb2256444c8dd3a2c8742ef

  • SHA512

    4bd5f13c39bf486235250267b0e2bb196e312e7b1ddc1a96fae0f3b7296cb5eb714e207053948ada2ea31bd7aa268df590181364b7dcb6a3b884330a28ee862b

  • SSDEEP

    3072:gnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0ks:gDn440zt46i4EruLorks

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      e0f72c2311c065288f47277e1961a09616f36a6daeb2256444c8dd3a2c8742ef

    • Size

      122KB

    • MD5

      2ffb189d0cbd907b95ca1f5a202a5f41

    • SHA1

      0b1e4239ab33878ca6aafaed4787ad22142907b7

    • SHA256

      e0f72c2311c065288f47277e1961a09616f36a6daeb2256444c8dd3a2c8742ef

    • SHA512

      4bd5f13c39bf486235250267b0e2bb196e312e7b1ddc1a96fae0f3b7296cb5eb714e207053948ada2ea31bd7aa268df590181364b7dcb6a3b884330a28ee862b

    • SSDEEP

      3072:gnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0ks:gDn440zt46i4EruLorks

    Score
    8/10
    persistencevmprotect

    • Sets DLL path for service in the registry

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks