Overview

overview

8

Static

static

74c6fb6a5e...2d.exe

windows7-x64

8

74c6fb6a5e...2d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74c6fb6a5ea9ae567888afb9c283be2786fa79176d1985f6d02af9e4067bf02d

  • Size

    2.7MB

  • Sample

    221126-jh6swsff6z

  • MD5

    92be13027d2a2988383895d7e5bef3e2

  • SHA1

    13060833535ab5d046ee6ce0a5a1adfcc0bac661

  • SHA256

    74c6fb6a5ea9ae567888afb9c283be2786fa79176d1985f6d02af9e4067bf02d

  • SHA512

    d8e80970b1752b2b851a737899c55281897b34e201bb186295e0527c3138b2c85e316e0207ab593a29a32e281740394697dbc8ba5483802a91e70a1fd932637d

  • SSDEEP

    49152:9Qg8kbx3u911s3fH6B5RVFYodEi8BaiUm5/Jvg0YsiOO50/e0nA8UdMT:9vVbx3u2faB5FYso/JvP19WfdMT

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      74c6fb6a5ea9ae567888afb9c283be2786fa79176d1985f6d02af9e4067bf02d

    • Size

      2.7MB

    • MD5

      92be13027d2a2988383895d7e5bef3e2

    • SHA1

      13060833535ab5d046ee6ce0a5a1adfcc0bac661

    • SHA256

      74c6fb6a5ea9ae567888afb9c283be2786fa79176d1985f6d02af9e4067bf02d

    • SHA512

      d8e80970b1752b2b851a737899c55281897b34e201bb186295e0527c3138b2c85e316e0207ab593a29a32e281740394697dbc8ba5483802a91e70a1fd932637d

    • SSDEEP

      49152:9Qg8kbx3u911s3fH6B5RVFYodEi8BaiUm5/Jvg0YsiOO50/e0nA8UdMT:9vVbx3u2faB5FYso/JvP19WfdMT

    Score
    8/10
    persistencevmprotect

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks