Overview

overview

10

Static

static

10

Built.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    14.9MB

  • Sample

    241012-wgxj2stalh

  • MD5

    8e4b101817f3602be5123c7e973d4bba

  • SHA1

    5a843fa236b58d8d31fe4d305f7d1b8600e0790b

  • SHA256

    7d071d1d701e4976ad512c52d6913a7429e29fc56aed5f596ae095b60f5a5eed

  • SHA512

    bbcb67e80878bb10f67754e666c222d56bd11463536e974aab112876b05cfb29247d286be7f62eff9bd9edd2e71c448a32b8c013de9311b6eda10c87e79e78b4

  • SSDEEP

    393216:qhzAhNKLlO7TcYEbi28qc4urEUWjZZ4dDLIeyzWGPTNCw:qhzcclscYGt8V4dbZZ6geWNh

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      14.9MB

    • MD5

      8e4b101817f3602be5123c7e973d4bba

    • SHA1

      5a843fa236b58d8d31fe4d305f7d1b8600e0790b

    • SHA256

      7d071d1d701e4976ad512c52d6913a7429e29fc56aed5f596ae095b60f5a5eed

    • SHA512

      bbcb67e80878bb10f67754e666c222d56bd11463536e974aab112876b05cfb29247d286be7f62eff9bd9edd2e71c448a32b8c013de9311b6eda10c87e79e78b4

    • SSDEEP

      393216:qhzAhNKLlO7TcYEbi28qc4urEUWjZZ4dDLIeyzWGPTNCw:qhzcclscYGt8V4dbZZ6geWNh

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks