Overview

overview

8

Static

static

e0c1f7c151...d3.exe

windows7-x64

8

e0c1f7c151...d3.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    e0c1f7c15101269d4fb671519ac6f635a14880f46766a7b44093b83ee42ae4d3

  • Size

    304KB

  • Sample

    221205-x3ef2abh5w

  • MD5

    4d683cb8f8b540c11c9c4c49f4a31ff7

  • SHA1

    191f5798a43fcff5d8e05cb90945e6b23be79704

  • SHA256

    e0c1f7c15101269d4fb671519ac6f635a14880f46766a7b44093b83ee42ae4d3

  • SHA512

    6504b48fbdd69031c1ac8eb09daf9ba9502c830236c43404bf21696ee362696551e10acdee87cc18e4a7ff5ebb546611d8a0025d744bec24436325f40b7e8fa9

  • SSDEEP

    3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

Score
8/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e0c1f7c15101269d4fb671519ac6f635a14880f46766a7b44093b83ee42ae4d3

    • Size

      304KB

    • MD5

      4d683cb8f8b540c11c9c4c49f4a31ff7

    • SHA1

      191f5798a43fcff5d8e05cb90945e6b23be79704

    • SHA256

      e0c1f7c15101269d4fb671519ac6f635a14880f46766a7b44093b83ee42ae4d3

    • SHA512

      6504b48fbdd69031c1ac8eb09daf9ba9502c830236c43404bf21696ee362696551e10acdee87cc18e4a7ff5ebb546611d8a0025d744bec24436325f40b7e8fa9

    • SSDEEP

      3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

    Score
    8/10
    evasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks