Overview

overview

10

Static

static

3

28028a7cd9...86.exe

windows7-x64

10

28028a7cd9...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28028a7cd9a23bde1b0029e6148af986

  • Size

    180KB

  • Sample

    231231-ezyrdscfh9

  • MD5

    28028a7cd9a23bde1b0029e6148af986

  • SHA1

    4a080ad3b399024615f229357847e079c6597af8

  • SHA256

    0710387a53ee2d45241f35f962168a5317469cd80244c85084f4bfe991495856

  • SHA512

    0dc87a51682e4dbceff5006574bab8c75eebd818af7c3599ef628717af7d02cbcd6b82268f15694544fa4725d54a25e5ce952867b292c62d5b2e2030838fa5ee

  • SSDEEP

    3072:F0cdgtALiLfa9o1mytjPGttGYmFbJ5Cc9bBBe9:KOgtBt1h+ttGYWfbu9

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      28028a7cd9a23bde1b0029e6148af986

    • Size

      180KB

    • MD5

      28028a7cd9a23bde1b0029e6148af986

    • SHA1

      4a080ad3b399024615f229357847e079c6597af8

    • SHA256

      0710387a53ee2d45241f35f962168a5317469cd80244c85084f4bfe991495856

    • SHA512

      0dc87a51682e4dbceff5006574bab8c75eebd818af7c3599ef628717af7d02cbcd6b82268f15694544fa4725d54a25e5ce952867b292c62d5b2e2030838fa5ee

    • SSDEEP

      3072:F0cdgtALiLfa9o1mytjPGttGYmFbJ5Cc9bBBe9:KOgtBt1h+ttGYWfbu9

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks