General

  • Target

    source_prepared.exe

  • Size

    52.0MB

  • Sample

    240806-m1lgfs1eqf

  • MD5

    89f978ed4b1ee844338baa49a8b8df56

  • SHA1

    7c0ab0a736b0653d2d7dbf334fc8c103b1640c43

  • SHA256

    e243a523691b3e6f42688b64368bb630573346f8c8cb640af0d88312d0c317bd

  • SHA512

    cd828304a94a80a918c7cc035d92a947331b34a11f35f02bee4feabce4acbed657d0b02bcaff1f7197651f4f099c98030c26b2679740dc6210ae4dac09fdad34

  • SSDEEP

    1572864:VhQ6l2C7vDSk8IpG7V+VPhqIbE7WjlbIEWIdZDmH:Vh1JPSkB05awIxjhIEFdc

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      52.0MB

    • MD5

      89f978ed4b1ee844338baa49a8b8df56

    • SHA1

      7c0ab0a736b0653d2d7dbf334fc8c103b1640c43

    • SHA256

      e243a523691b3e6f42688b64368bb630573346f8c8cb640af0d88312d0c317bd

    • SHA512

      cd828304a94a80a918c7cc035d92a947331b34a11f35f02bee4feabce4acbed657d0b02bcaff1f7197651f4f099c98030c26b2679740dc6210ae4dac09fdad34

    • SSDEEP

      1572864:VhQ6l2C7vDSk8IpG7V+VPhqIbE7WjlbIEWIdZDmH:Vh1JPSkB05awIxjhIEFdc

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks