Overview

overview

8

Static

static

3

DevxExecutor.exe

windows11-21h2-x64

8

Resubmissions

09-05-2024 12:59

240509-p8d4fsdf27 10

09-05-2024 12:50

240509-p298badc26 10

09-05-2024 12:45

240509-py7b9aab8t 8

09-05-2024 12:25

240509-plr2sscb99 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DevxExecutor.exe

  • Size

    44.1MB

  • Sample

    240509-py7b9aab8t

  • MD5

    e4897ef7419e128b1f7473119ce0bd07

  • SHA1

    5aad252412a5923438f30cb9c397731a9b020121

  • SHA256

    6d5ba38a5e9bde7939ac5dcb8fdcb970701168064d30abcf518cf8d272a0f581

  • SHA512

    db66ea2cb3f5f30934ab071e1dd2e7b41f6dc5c4be125f1d2d6aab627b3be8b6cf8fcbed517a414cdf037a068414b178176edba2e28de6419b65269e0abb162c

  • SSDEEP

    786432:NCZkrrfdktmLX8t8lBBvUPlZIOPuOI64zlNWtVMoOIsuXzfVib4a9BWN:N4GlkcLMtUzilKUINzmtVkMfWo

Score
8/10
discoveryevasionexecutionpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      DevxExecutor.exe

    • Size

      44.1MB

    • MD5

      e4897ef7419e128b1f7473119ce0bd07

    • SHA1

      5aad252412a5923438f30cb9c397731a9b020121

    • SHA256

      6d5ba38a5e9bde7939ac5dcb8fdcb970701168064d30abcf518cf8d272a0f581

    • SHA512

      db66ea2cb3f5f30934ab071e1dd2e7b41f6dc5c4be125f1d2d6aab627b3be8b6cf8fcbed517a414cdf037a068414b178176edba2e28de6419b65269e0abb162c

    • SSDEEP

      786432:NCZkrrfdktmLX8t8lBBvUPlZIOPuOI64zlNWtVMoOIsuXzfVib4a9BWN:N4GlkcLMtUzilKUINzmtVkMfWo

    Score
    8/10
    discoveryevasionexecutionpyinstallerspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Contacts a large (925) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Network Service Discovery

1
T1046

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

1
T1489

Tasks