Overview

overview

10

Static

static

3

d650ca2e68...d8.exe

windows7-x64

10

d650ca2e68...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d650ca2e682cb09e2f9ec819425744d20fcc1af7275658f0e4195e7947b69ed8

  • Size

    1.5MB

  • Sample

    230612-klmpvsbb28

  • MD5

    2aebccb13a5eb9e4b2e6b30ffa86517c

  • SHA1

    c60059bd304377db3a1c0d1e0306e75f655d5ccb

  • SHA256

    d650ca2e682cb09e2f9ec819425744d20fcc1af7275658f0e4195e7947b69ed8

  • SHA512

    ad5fec1475d45a7affab64af4d73554be8e0e6f4e307562332929f4af4b6147fd45ae14d0c52addc41a55398d0e5923647a88875cd6cf4d2129fd024c83b82ac

  • SSDEEP

    24576:YUBOm6E14+kMHm2wGYeAI2/FwBuqJNblwRCJFFOSyzQOB:YUBOmXe+FHmyJAI2WBukNbWcOSAF

Score
10/10
aspackv2evasiontrojan

Malware Config

Targets

    • Target

      d650ca2e682cb09e2f9ec819425744d20fcc1af7275658f0e4195e7947b69ed8

    • Size

      1.5MB

    • MD5

      2aebccb13a5eb9e4b2e6b30ffa86517c

    • SHA1

      c60059bd304377db3a1c0d1e0306e75f655d5ccb

    • SHA256

      d650ca2e682cb09e2f9ec819425744d20fcc1af7275658f0e4195e7947b69ed8

    • SHA512

      ad5fec1475d45a7affab64af4d73554be8e0e6f4e307562332929f4af4b6147fd45ae14d0c52addc41a55398d0e5923647a88875cd6cf4d2129fd024c83b82ac

    • SSDEEP

      24576:YUBOm6E14+kMHm2wGYeAI2/FwBuqJNblwRCJFFOSyzQOB:YUBOmXe+FHmyJAI2WBukNbWcOSAF

    Score
    10/10
    aspackv2evasiontrojan

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks