Overview

overview

8

Static

static

7

Yeni klasĂ...XW.exe

windows7-x64

8

Yeni klasĂ...XW.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Yeni klasör.zip

  • Size

    4.9MB

  • Sample

    240423-yxwc2abd3w

  • MD5

    37f446c7245f0a4046c5fe2e91af3645

  • SHA1

    809deb43ee01b45f369e5c118ac9e603857574e4

  • SHA256

    04afee12ca1e37ffbe0701001ddfe4f61e85ec94d2c3d061ba0d4860c88dadb7

  • SHA512

    b8f247d6eab7470beba3ac13c6c6e698e2b4b2da70e481585db26bdcccb36f29a662abb5c87fdf8ca3d02182dd9d43f0d5bda6bf7b2857115d9d8a653bbfc950

  • SSDEEP

    98304:ctb1nFT7wTBE3UYw6Lnxpxvetm/IAQUvCUKrxS3rjcPTiFs3TB:qp6CvnLnZam/FCUbjMTiC9

Score
8/10
evasionvmprotect

Malware Config

Targets

    • Target

      Yeni klasör/aUGHgUfP5uUTa1LJsXW.exe

    • Size

      5.0MB

    • MD5

      6de94ac30a250d3e6e1585d9eca2201b

    • SHA1

      f5d885d741089fe610a8983e2a852b15445d8c50

    • SHA256

      4f4ede8c7abb0ffe10d95dd4018e16676fef7b732e4ec3bb44522c90d5c13f33

    • SHA512

      fca8deb08f52f8fec49d90c6ef0844b157ee9bf24df270cf141f840570cfe884e11a567a162350336e09ea9379c49fd68823250b982f65d1bee62160f45cfac4

    • SSDEEP

      98304:JobMplntPg/l43UiIEVnzDbsxzI3OfVAGeu63RfGn2A5u1:u6tGC9LVnKEw0e2A5u1

    Score
    8/10
    evasionvmprotect

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Stops running service(s)

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks