Overview

overview

10

Static

static

dc5978a40e...98.exe

windows7-x64

10

dc5978a40e...98.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc5978a40e874d4fd84fc68f9f4be76a5e0d7682c8f49f1fc3367267a8084c98

  • Size

    74KB

  • Sample

    221205-3ejczabb2w

  • MD5

    624358ac0a6174dee968a9647fe071b9

  • SHA1

    fe839aef79c4b875ddc98f34109e11944381ddff

  • SHA256

    dc5978a40e874d4fd84fc68f9f4be76a5e0d7682c8f49f1fc3367267a8084c98

  • SHA512

    d8eed0626e5c55278f60b7457e76fb5aadec0d3196771d6d4ca9788f376ca551988fc496975bccf46a9f42a57d098f010ff2b54fa49682787e2da4f289322fd5

  • SSDEEP

    768:bXJqKO1mkZgxTa5IEYy3V1kDtuoqt7fA0Ex45hwxtI1+PspBi/K+3l/1PSdPGaNn:b54ZxTYI1gQo8r3WtIcPspr+doRmLSl

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      dc5978a40e874d4fd84fc68f9f4be76a5e0d7682c8f49f1fc3367267a8084c98

    • Size

      74KB

    • MD5

      624358ac0a6174dee968a9647fe071b9

    • SHA1

      fe839aef79c4b875ddc98f34109e11944381ddff

    • SHA256

      dc5978a40e874d4fd84fc68f9f4be76a5e0d7682c8f49f1fc3367267a8084c98

    • SHA512

      d8eed0626e5c55278f60b7457e76fb5aadec0d3196771d6d4ca9788f376ca551988fc496975bccf46a9f42a57d098f010ff2b54fa49682787e2da4f289322fd5

    • SSDEEP

      768:bXJqKO1mkZgxTa5IEYy3V1kDtuoqt7fA0Ex45hwxtI1+PspBi/K+3l/1PSdPGaNn:b54ZxTYI1gQo8r3WtIcPspr+doRmLSl

    Score
    10/10
    evasionpersistenceupx

    • Modifies security service

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks