General
-
Target
f561ee026ad652bed5d2dbca19b0f6da.bin
-
Size
2.9MB
-
Sample
240425-cxz6bsdf37
-
MD5
a2a9c037b58c00b58702644255baf869
-
SHA1
3ba85e36639a296061adae19e4213c3fbd7e1d9c
-
SHA256
e9f819fec74adede963a3a4c92323a157ae30965d09730682f3d94cf8c963acd
-
SHA512
3455affc8a75e438cdb5b9eea41eb5761de7830d9a2756667943a0af2fd88d38947d5aceff1f02dfaeb2e7dee073762039683c62aee79a876228de2326c33a9c
-
SSDEEP
49152:EBtNwW+yycLBa4kxSia0RU7ovqO7kia6HNhm3iKukMgUC6JHW1fWYlCpqO:qt2W+RErk2cyEvpj1ZHW1ftcqO
Static task
static1
Behavioral task
behavioral1
Sample
c35d5fb22d47e276e38fde699fc3b1e88e60a708d85b6ebea69815dec5d4883e.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
c35d5fb22d47e276e38fde699fc3b1e88e60a708d85b6ebea69815dec5d4883e.exe
-
Size
2.9MB
-
MD5
f561ee026ad652bed5d2dbca19b0f6da
-
SHA1
42a9d231a9c44331ac6f6327de9e3fa7d796c3d4
-
SHA256
c35d5fb22d47e276e38fde699fc3b1e88e60a708d85b6ebea69815dec5d4883e
-
SHA512
52de39805c40f30f2ab7aebd6f143cc1d5ecd6bb95b767a45d4c212f48ee16df6425309463d2cc8703dfa0cb796b42fafb75dfd7836f65ee09e13c9318c31e4e
-
SSDEEP
49152:GC5pOewgkXW0aOtXZpv8axPoPADdvcPru1221mduTjSuoqaesz+pgInL/rKUvYp:jjInXW0tXZaaxPoPkvR2kSu1phnL/rYp
-
Looks for VirtualBox Guest Additions in registry
-
XMRig Miner payload
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
2