Overview

overview

10

Static

static

10

Built.exe

windows7-x64

7

Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    7.5MB

  • Sample

    241019-kd1azsycnl

  • MD5

    cb06608822085f5911fc76736f13bc97

  • SHA1

    89322abb771c956b61f42309a5d27bb84afc62bb

  • SHA256

    9ad34ccc1e2fb6b719f4804117796ae7e826654bdfd8f36ae2366e836ff823ae

  • SHA512

    2207187ab730b07912877e7ef5e66c4b694eacaa04060e6b801b840bffa949c5ebd2316e16b26c303a7b2f0d34f1edd8dec8a9adc3664ac71f5e4e0a374b0d36

  • SSDEEP

    196608:zSgFHwfI9jUC2gYBYv3vbW5+iITm1U6f2:/FMIH2gYBgDW4TOzu

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      7.5MB

    • MD5

      cb06608822085f5911fc76736f13bc97

    • SHA1

      89322abb771c956b61f42309a5d27bb84afc62bb

    • SHA256

      9ad34ccc1e2fb6b719f4804117796ae7e826654bdfd8f36ae2366e836ff823ae

    • SHA512

      2207187ab730b07912877e7ef5e66c4b694eacaa04060e6b801b840bffa949c5ebd2316e16b26c303a7b2f0d34f1edd8dec8a9adc3664ac71f5e4e0a374b0d36

    • SSDEEP

      196608:zSgFHwfI9jUC2gYBYv3vbW5+iITm1U6f2:/FMIH2gYBgDW4TOzu

    Score
    8/10
    discoveryupxexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks