Overview

overview

7

Static

static

7

4ddig-for-...01.exe

windows7-x64

7

4ddig-for-...01.exe

windows10-2004-x64

7

Resubmissions

03/09/2024, 12:38

240903-pt3hhawhln 7

03/09/2024, 12:37

240903-ptre8sxhpg 7

03/09/2024, 11:57

240903-n4zc6axcmc 7

Sharing

Copy URL Twitter E-mail

General

  • Target

    4ddig-for-windows-free_11725364633759053201.exe

  • Size

    2.0MB

  • Sample

    240903-n4zc6axcmc

  • MD5

    d3ac2fe920db837547b7409c4f50d0a3

  • SHA1

    4b8aa8e053a97ce72e95fd1bfeeb4b9184648040

  • SHA256

    80eb332f52c73798ee2737836b45c184330baabd176796fe5568e134de4c1ab1

  • SHA512

    d55fb1c0a316e27d406b29410343d05f2823f07b3c703a75a3f973b7c610be74aff87c61218979c452bd280ef12e767379493c3417c072c1697925137819b192

  • SSDEEP

    49152:zqU+lyxZS9qgC4ehhOCHPAgjtrr5N7k3oWYLbipxwGy1x9Xq:9oyxZSbmh/Ygj55pk3o/LeyTdq

Score
7/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      4ddig-for-windows-free_11725364633759053201.exe

    • Size

      2.0MB

    • MD5

      d3ac2fe920db837547b7409c4f50d0a3

    • SHA1

      4b8aa8e053a97ce72e95fd1bfeeb4b9184648040

    • SHA256

      80eb332f52c73798ee2737836b45c184330baabd176796fe5568e134de4c1ab1

    • SHA512

      d55fb1c0a316e27d406b29410343d05f2823f07b3c703a75a3f973b7c610be74aff87c61218979c452bd280ef12e767379493c3417c072c1697925137819b192

    • SSDEEP

      49152:zqU+lyxZS9qgC4ehhOCHPAgjtrr5N7k3oWYLbipxwGy1x9Xq:9oyxZSbmh/Ygj55pk3o/LeyTdq

    Score
    7/10
    discoveryevasionpersistenceprivilege_escalationupxdefense_evasion

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies Windows Firewall

      evasion

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks