Overview

overview

10

Static

static

8

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    4.9MB

  • Sample

    230117-y65m3abf7s

  • MD5

    619c8566b61a49d28d25590a16611849

  • SHA1

    d6c75e985d9ae6ff79b29bf39cac1d7514e7a473

  • SHA256

    aa0a1f379ba188db1bec2c91b483e9b628ddc319da17876cc0bab9d75b756cd2

  • SHA512

    a367b2188076923c050879685196dcbbe036dd317e0c976a45999008938fe15621ed69691e9817965df0957abe1a00017ddbe6fa0b0d83a6c5b66ca08de63363

  • SSDEEP

    98304:ZlsCMnpZW6zAEqWn4mb8AarnNGEsOOFUySajl69XE:bsdnm68Ev44/2nk8OF1xjl69

Score
10/10
discoveryevasionexploitvmprotect

Malware Config

Targets

    • Target

      tmp

    • Size

      4.9MB

    • MD5

      619c8566b61a49d28d25590a16611849

    • SHA1

      d6c75e985d9ae6ff79b29bf39cac1d7514e7a473

    • SHA256

      aa0a1f379ba188db1bec2c91b483e9b628ddc319da17876cc0bab9d75b756cd2

    • SHA512

      a367b2188076923c050879685196dcbbe036dd317e0c976a45999008938fe15621ed69691e9817965df0957abe1a00017ddbe6fa0b0d83a6c5b66ca08de63363

    • SSDEEP

      98304:ZlsCMnpZW6zAEqWn4mb8AarnNGEsOOFUySajl69XE:bsdnm68Ev44/2nk8OF1xjl69

    Score
    10/10
    discoveryevasionexploitvmprotect

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks