Overview

overview

8

Static

static

ca29cb8761...39.exe

windows7-x64

8

ca29cb8761...39.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca29cb876118289fe34d87934041d2f4716304a613965c5333b523ab52071339

  • Size

    114KB

  • Sample

    221201-waxw8scg25

  • MD5

    5615de664bf369392cca31b1db56f7dc

  • SHA1

    4d4dbe4fd4f94dc8f17b5f0751bf47d0b3827dc9

  • SHA256

    ca29cb876118289fe34d87934041d2f4716304a613965c5333b523ab52071339

  • SHA512

    49309335ec10c099ba22ca0d4f82c0ec40332a071843a91fe106bd9f80d1430906c3b1e2921d6f703860007cf2c41315d4aae8d62e747644ae7508957515a48b

  • SSDEEP

    1536:CHUTY4SjtmgY2g1pP6WLgXLnAD74twTKaAqMzIgm55xATb6WPue6R5Dq:wlxjt41pMLna78wTz8Igm7x+vP3iDq

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      ca29cb876118289fe34d87934041d2f4716304a613965c5333b523ab52071339

    • Size

      114KB

    • MD5

      5615de664bf369392cca31b1db56f7dc

    • SHA1

      4d4dbe4fd4f94dc8f17b5f0751bf47d0b3827dc9

    • SHA256

      ca29cb876118289fe34d87934041d2f4716304a613965c5333b523ab52071339

    • SHA512

      49309335ec10c099ba22ca0d4f82c0ec40332a071843a91fe106bd9f80d1430906c3b1e2921d6f703860007cf2c41315d4aae8d62e747644ae7508957515a48b

    • SSDEEP

      1536:CHUTY4SjtmgY2g1pP6WLgXLnAD74twTKaAqMzIgm55xATb6WPue6R5Dq:wlxjt41pMLna78wTz8Igm7x+vP3iDq

    Score
    8/10
    persistencevmprotect

    • Modifies AppInit DLL entries

      persistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks