Resubmissions

25-08-2024 23:53

240825-3xfpsssemd 10

25-08-2024 23:50

240825-3vnydstgpk 10

General

  • Target

    source_prepared.exe

  • Size

    80.3MB

  • Sample

    240825-3xfpsssemd

  • MD5

    52102f70cfd61a716325833666b0180e

  • SHA1

    625ccc40c919e34554bd178279b02268a6c6fcfe

  • SHA256

    44adad36384d5fe063fec38dd156b6d923968eb05e1ebb4fad7b55fea983eee4

  • SHA512

    dd6df976430a3d828ce14c05b8158f181a50e1722bced4c224d09ae98fb3171d03d55babca6a591f8d5c39795f17f789dda4336324e8c40d0d3529e5345ef457

  • SSDEEP

    1572864:70bZQglGWLo7vPSk8IpG7V+VPhq+EE74lgbiYgj+h58sMwL9ZC2cJzU:70bZxkHLSkB05aw+yeV5n9ZaU

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.3MB

    • MD5

      52102f70cfd61a716325833666b0180e

    • SHA1

      625ccc40c919e34554bd178279b02268a6c6fcfe

    • SHA256

      44adad36384d5fe063fec38dd156b6d923968eb05e1ebb4fad7b55fea983eee4

    • SHA512

      dd6df976430a3d828ce14c05b8158f181a50e1722bced4c224d09ae98fb3171d03d55babca6a591f8d5c39795f17f789dda4336324e8c40d0d3529e5345ef457

    • SSDEEP

      1572864:70bZQglGWLo7vPSk8IpG7V+VPhq+EE74lgbiYgj+h58sMwL9ZC2cJzU:70bZxkHLSkB05aw+yeV5n9ZaU

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks