Overview

overview

8

Static

static

8

006c3a6b21...31.exe

windows7-x64

8

006c3a6b21...31.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    006c3a6b21d5b6b736829a98f0b831c5f92ef3e8e2b54735898de65cb2fe2231

  • Size

    1.3MB

  • Sample

    221127-jvs3kabc56

  • MD5

    594fdce95c1083562ed13d9a15c27e46

  • SHA1

    9c5b3173d5435aa3d1bd3ddf5cb5a65c6fd6b093

  • SHA256

    006c3a6b21d5b6b736829a98f0b831c5f92ef3e8e2b54735898de65cb2fe2231

  • SHA512

    2f33f005e6fd9baf1a256b27c7f0f96345405dce83b6ae939642c3ae2f88d61d334029bebf427936b61d789bb18365eb61a87777a00a4c2fcc95beda827bb573

  • SSDEEP

    24576:z0c9XhbYn/IIJolzJOyQXEWcKKev1agjVdkV:gchc1OwXRnKo1tJdk

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      006c3a6b21d5b6b736829a98f0b831c5f92ef3e8e2b54735898de65cb2fe2231

    • Size

      1.3MB

    • MD5

      594fdce95c1083562ed13d9a15c27e46

    • SHA1

      9c5b3173d5435aa3d1bd3ddf5cb5a65c6fd6b093

    • SHA256

      006c3a6b21d5b6b736829a98f0b831c5f92ef3e8e2b54735898de65cb2fe2231

    • SHA512

      2f33f005e6fd9baf1a256b27c7f0f96345405dce83b6ae939642c3ae2f88d61d334029bebf427936b61d789bb18365eb61a87777a00a4c2fcc95beda827bb573

    • SSDEEP

      24576:z0c9XhbYn/IIJolzJOyQXEWcKKev1agjVdkV:gchc1OwXRnKo1tJdk

    Score
    8/10
    vmprotectpersistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks