Overview

overview

10

Static

static

10

Built.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    6.9MB

  • Sample

    241027-x5p1js1dld

  • MD5

    3cc660d3a85c25826a5f1af41511db25

  • SHA1

    69183e43df0f931970d16e7d6637c5fb4eeee799

  • SHA256

    aa9582350b7bdfda4c705f9dc7f8acc00ad767645b3a25bd92ff25fe4af2685e

  • SHA512

    9ae88b78733cf91f46c1fb2fa787241f76b9351723deb3a2393d482d6a862e7b0d5a9f93116dbec2f81aa4e96b1b3160c29e253816e024fe9ca637ce85e5e3f2

  • SSDEEP

    196608:mIV1vVhB6ylnlPzf+JiJCsmFMvln6hqg2:5VhBRlnlPSa7mmvlpg2

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      6.9MB

    • MD5

      3cc660d3a85c25826a5f1af41511db25

    • SHA1

      69183e43df0f931970d16e7d6637c5fb4eeee799

    • SHA256

      aa9582350b7bdfda4c705f9dc7f8acc00ad767645b3a25bd92ff25fe4af2685e

    • SHA512

      9ae88b78733cf91f46c1fb2fa787241f76b9351723deb3a2393d482d6a862e7b0d5a9f93116dbec2f81aa4e96b1b3160c29e253816e024fe9ca637ce85e5e3f2

    • SSDEEP

      196608:mIV1vVhB6ylnlPzf+JiJCsmFMvln6hqg2:5VhBRlnlPSa7mmvlpg2

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks