Overview

overview

7

Static

static

7

b5aa93f9fb...16.exe

windows7-x64

7

b5aa93f9fb...16.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5aa93f9fb4e992747e86faee9f67bb3753a676288c238fe891ef4fc8b8b1516

  • Size

    5.6MB

  • Sample

    240425-y11f6aeb63

  • MD5

    86ba5edde1fd0d0c7af48563c3f2d9f4

  • SHA1

    58cbe7f157cfdd91bff83df307eb8be6b8cd76e2

  • SHA256

    b5aa93f9fb4e992747e86faee9f67bb3753a676288c238fe891ef4fc8b8b1516

  • SHA512

    8384b6f329d83ca3f46e7d603a5675829a8ab2330127e9b0141ed5dde31179af244efa0a34393c55c3aaac6eda0ea5c643960976a3bac1f62d3116aada3d81f7

  • SSDEEP

    98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82h:ExHffaoRD8AKQSe+sGUeFnEOQEofz/Q/

Score
7/10
persistencevmprotect

Malware Config

Targets

    • Target

      b5aa93f9fb4e992747e86faee9f67bb3753a676288c238fe891ef4fc8b8b1516

    • Size

      5.6MB

    • MD5

      86ba5edde1fd0d0c7af48563c3f2d9f4

    • SHA1

      58cbe7f157cfdd91bff83df307eb8be6b8cd76e2

    • SHA256

      b5aa93f9fb4e992747e86faee9f67bb3753a676288c238fe891ef4fc8b8b1516

    • SHA512

      8384b6f329d83ca3f46e7d603a5675829a8ab2330127e9b0141ed5dde31179af244efa0a34393c55c3aaac6eda0ea5c643960976a3bac1f62d3116aada3d81f7

    • SSDEEP

      98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82h:ExHffaoRD8AKQSe+sGUeFnEOQEofz/Q/

    Score
    7/10
    persistencevmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks