Overview

overview

10

Static

static

10

a93ee68a88...33.exe

windows7-x64

10

a93ee68a88...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5de893b2e4e2ca63e3dfba1ca8fd57bb44b920fd25c1c6c720bb15c3bae45f12

  • Size

    40KB

  • Sample

    240419-wywn3sbg84

  • MD5

    1887e84a16365a8de7522804b86dac25

  • SHA1

    f2f6edd89efa30cf81ce77e7b5b6787ef5401824

  • SHA256

    5de893b2e4e2ca63e3dfba1ca8fd57bb44b920fd25c1c6c720bb15c3bae45f12

  • SHA512

    c5e6ca653ad00341818aad0fdcd36aea3a8df85f80a999f010489bca71cd98feda5985181a0c6a7df3d901420a71c4e964c5e30c402ac06bceeb3d33c8e1b735

  • SSDEEP

    768:eByxBsk5GPi2v797PnMJgS6mLPZqZJHYERvkKCHmJykqHhkbqmpK+fMYpqXp9tOP:tPsTPiO9TMJ9RLxCJ48CHmnEhL+fnU5e

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Targets

    • Target

      a93ee68a88babf80e9ea7af2f0c31115a98680d14af4a3ec6bcb60b7c6199533

    • Size

      71KB

    • MD5

      2579743d5d6f411afee80e1098227c25

    • SHA1

      eb699525b239622757938423bf2c8e3b373978c5

    • SHA256

      a93ee68a88babf80e9ea7af2f0c31115a98680d14af4a3ec6bcb60b7c6199533

    • SHA512

      ac2581bf951241684b61fcc7e64cd6af6a471100a9dd1da00c7019bf67ddcdfa5221f06497b3a8b3119f05aa341a1f41f64340fbefc614792a88995b34787ff6

    • SSDEEP

      768:orVDC3OYPR+P+3CYOyyEStf0wmWQgoUqwo8IwGKd3ybg7lyL10XI3Ou4sbwL/Umj:or4FR+tYdHSsWQdJ9EEJ3CpfiViKxt

    Score
    10/10
    xoristpersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Renames multiple (1841) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks