Overview

overview

10

Static

static

10

rename_thi...ma.exe

windows7-x64

7

rename_thi...ma.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rename_this.exe_spiggma.exe

  • Size

    8.2MB

  • Sample

    240925-qhtxnaxcnm

  • MD5

    be18cc881d677eae8b8a1fe7aca8c13b

  • SHA1

    9ddc10b45d85ef3799945345ad0d65e03a318402

  • SHA256

    5290acd0ac2c3500e3b23d23a8c9bd121215813127fe80e6ecab71ef3c7cadd6

  • SHA512

    388560e1fb75e97d9245633b4e5dd738c382b401c1646bca4ad64ffaecbe3e8b9359da249434fc24b4c7bf840630cad1960ae903376a51184fdfd9ba307be149

  • SSDEEP

    196608:gXg8VEjWwfI9jUC2gYBYv3vbW4SEf+iITx1U6nZ:l8VEjdIH2gYBgDWZjTnzZ

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      rename_this.exe_spiggma.exe

    • Size

      8.2MB

    • MD5

      be18cc881d677eae8b8a1fe7aca8c13b

    • SHA1

      9ddc10b45d85ef3799945345ad0d65e03a318402

    • SHA256

      5290acd0ac2c3500e3b23d23a8c9bd121215813127fe80e6ecab71ef3c7cadd6

    • SHA512

      388560e1fb75e97d9245633b4e5dd738c382b401c1646bca4ad64ffaecbe3e8b9359da249434fc24b4c7bf840630cad1960ae903376a51184fdfd9ba307be149

    • SSDEEP

      196608:gXg8VEjWwfI9jUC2gYBYv3vbW4SEf+iITx1U6nZ:l8VEjdIH2gYBgDWZjTnzZ

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks