General

  • Target

    c2w.exe

  • Size

    78.4MB

  • Sample

    240803-vcnkxatflh

  • MD5

    5916f495786c1d89d435a64648f3d618

  • SHA1

    b2b7e1a52f409dade119970ab8dbd323d4b2d550

  • SHA256

    782b2bc1933557d1dc21815923bfcc2f574db81d23b354c2404bc8254e59b439

  • SHA512

    d1ee9f7b345c08c30683ce44b4de8a0e66fd311d52373c12ee19310ee04a8a58d5bf8bdb1343ac1fab66e62cf2642d2b0f7f9176972554471e4edf3edb619b7e

  • SSDEEP

    1572864:ZvHcRlNeh7vXSk8IpG7V+VPhqudSsE7FFlHFCiYweyJulZUdgvdW4lZuxa/Z9UN/:ZvHcROhTSkB05awSSBdNpurdRas9U

Malware Config

Targets

    • Target

      c2w.exe

    • Size

      78.4MB

    • MD5

      5916f495786c1d89d435a64648f3d618

    • SHA1

      b2b7e1a52f409dade119970ab8dbd323d4b2d550

    • SHA256

      782b2bc1933557d1dc21815923bfcc2f574db81d23b354c2404bc8254e59b439

    • SHA512

      d1ee9f7b345c08c30683ce44b4de8a0e66fd311d52373c12ee19310ee04a8a58d5bf8bdb1343ac1fab66e62cf2642d2b0f7f9176972554471e4edf3edb619b7e

    • SSDEEP

      1572864:ZvHcRlNeh7vXSk8IpG7V+VPhqudSsE7FFlHFCiYweyJulZUdgvdW4lZuxa/Z9UN/:ZvHcROhTSkB05awSSBdNpurdRas9U

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks