Overview

overview

8

Static

static

1

DarkAndDarker.exe

windows10-1703-x64

8

Resubmissions

12/02/2023, 16:26

230212-txwatafb29 8

12/02/2023, 16:23

230212-tv8s5aee3x 7

12/02/2023, 16:19

230212-tstlesed91 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DarkAndDarker.exe

  • Size

    524KB

  • Sample

    230212-txwatafb29

  • MD5

    03ce509029c87b2417f1ed177272bb26

  • SHA1

    303d75e993ddf33554146fd0a99fefb15e5fef0d

  • SHA256

    9e9aa5b227eb60536afd2e77535e2c3e0ba80aa9fe94b89bae2c4d744e9dfd41

  • SHA512

    1614ecfef8721a7cba6bde263e50040a76e1584e106a63ebc12d581a3b62d6fd30c2d5d389af3cb94793701bf89b1b34870a4b5ef34e1cdaf7d5a9b314150b9f

  • SSDEEP

    12288:XKPKWN94XMTj83oO0hBUodeE5kYVGPo836TwmGO:ajCMTjhOI2odI1Po8368O

Score
8/10
evasionvmprotect

Malware Config

Targets

    • Target

      DarkAndDarker.exe

    • Size

      524KB

    • MD5

      03ce509029c87b2417f1ed177272bb26

    • SHA1

      303d75e993ddf33554146fd0a99fefb15e5fef0d

    • SHA256

      9e9aa5b227eb60536afd2e77535e2c3e0ba80aa9fe94b89bae2c4d744e9dfd41

    • SHA512

      1614ecfef8721a7cba6bde263e50040a76e1584e106a63ebc12d581a3b62d6fd30c2d5d389af3cb94793701bf89b1b34870a4b5ef34e1cdaf7d5a9b314150b9f

    • SSDEEP

      12288:XKPKWN94XMTj83oO0hBUodeE5kYVGPo836TwmGO:ajCMTjhOI2odI1Po8368O

    Score
    8/10
    evasionvmprotect

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks