Overview

overview

10

Static

static

10

2024-03-11...ia.exe

windows7-x64

10

2024-03-11...ia.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

  • Size

    4.0MB

  • Sample

    240311-ef6b5abd97

  • MD5

    e9700ee19d13bc5d0bff829cfd9335df

  • SHA1

    67d67d24e0d0c5bf3e0f9d54a219caf2245fd092

  • SHA256

    86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac

  • SHA512

    c8aad6429933b30fc74a61a7cad7226c55e04f8cd4436bd4581decf5bbaaea1eee74ca7a09262e12b9f512337e37c9d2e7e86f732c8e18cfc674b92d82086da0

  • SSDEEP

    49152:e1aJm5TYkvCkXUfHR/SuF5QZuTtS0rQMYOQ+q8CEM3YHcY0W3luNaeae7nHzc9KG:0U0SfHxSuFWsM0r1QnbAO5zvc0FeZ

Score
10/10
upxvmprotect

Malware Config

Targets

    • Target

      2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

    • Size

      4.0MB

    • MD5

      e9700ee19d13bc5d0bff829cfd9335df

    • SHA1

      67d67d24e0d0c5bf3e0f9d54a219caf2245fd092

    • SHA256

      86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac

    • SHA512

      c8aad6429933b30fc74a61a7cad7226c55e04f8cd4436bd4581decf5bbaaea1eee74ca7a09262e12b9f512337e37c9d2e7e86f732c8e18cfc674b92d82086da0

    • SSDEEP

      49152:e1aJm5TYkvCkXUfHR/SuF5QZuTtS0rQMYOQ+q8CEM3YHcY0W3luNaeae7nHzc9KG:0U0SfHxSuFWsM0r1QnbAO5zvc0FeZ

    Score
    10/10
    upxvmprotect

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Detects executables packed with VMProtect.

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks