a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9 | Triage

Submit
Reports

Overview

overview

8

Static

static

a4cdbe6393...a9.exe

windows7-x64

8

a4cdbe6393...a9.exe

windows10-2004-x64

3

Sharing

General

Target

a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9
Size

493KB
Sample

221206-rzfa9sag2v
MD5

8e2b7d4d79ed6919219d4c5ea7ffd848
SHA1

4e4b9aac9fea1ec8b0cb7e70e9c6fdedd3121619
SHA256

a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9
SHA512

ca388614ae699f5b5d850c2dc61e3c39eda9b1b15a03d9c0610143e2bbd8160dddaffaed6bd1be56160596e90962b10d0291d881d96bf91ef23f821ad1cfa4c7
SSDEEP

12288:n21rQFx6mpvXhq3wQbrqNOOQvrceK4XcCCy:n218FxZ3logwKClx

Score

8^/10

evasion persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9.exe

Resource

win7-20221111-en

evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9
- Size
  
  493KB
- MD5
  
  8e2b7d4d79ed6919219d4c5ea7ffd848
- SHA1
  
  4e4b9aac9fea1ec8b0cb7e70e9c6fdedd3121619
- SHA256
  
  a4cdbe639328beb3a9ce17554ada187e0ea9f3ec946ebb270904bcdcc62e5aa9
- SHA512
  
  ca388614ae699f5b5d850c2dc61e3c39eda9b1b15a03d9c0610143e2bbd8160dddaffaed6bd1be56160596e90962b10d0291d881d96bf91ef23f821ad1cfa4c7
- SSDEEP
  
  12288:n21rQFx6mpvXhq3wQbrqNOOQvrceK4XcCCy:n218FxZ3logwKClx
Score

8^/10

evasion persistence upx
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

© 2018-2024

Terms | Privacy