Overview

overview

10

Static

static

10

exedome.exe

windows11-21h2-x64

9

Resubmissions

20-06-2024 01:15

240620-bmcfva1aja 10

28-05-2024 18:46

240528-xew16sff8x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    exedome.exe

  • Size

    76.5MB

  • Sample

    240528-xew16sff8x

  • MD5

    8a3563018dd10ddcc71c892f105a7e9a

  • SHA1

    bed7093d31b4391c26195a3593f5260fa969d81d

  • SHA256

    f2a3d7f510b073199b45a142fa6dbf2198d67bdb86f4c5a117c8dd0d1b4b7ce5

  • SHA512

    901b3338fb248e81a8b258bf6f3510988d6dfdd6e59a23c50e113dd29a4b5c3081e79802a889501c0b3193e083366117ef10c429396b13a8310a2eed77e5165e

  • SSDEEP

    1572864:WfKLjjB6ESk8IpG7V+VPhqgddBE7ujxnPRQvbXhQaE/zsp40WVKj9Ujnb8g:WfejlSkB05aw0dptn2bXhQ10c2v

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      exedome.exe

    • Size

      76.5MB

    • MD5

      8a3563018dd10ddcc71c892f105a7e9a

    • SHA1

      bed7093d31b4391c26195a3593f5260fa969d81d

    • SHA256

      f2a3d7f510b073199b45a142fa6dbf2198d67bdb86f4c5a117c8dd0d1b4b7ce5

    • SHA512

      901b3338fb248e81a8b258bf6f3510988d6dfdd6e59a23c50e113dd29a4b5c3081e79802a889501c0b3193e083366117ef10c429396b13a8310a2eed77e5165e

    • SSDEEP

      1572864:WfKLjjB6ESk8IpG7V+VPhqgddBE7ujxnPRQvbXhQaE/zsp40WVKj9Ujnb8g:WfejlSkB05aw0dptn2bXhQ10c2v

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks