Overview

overview

10

Static

static

10

8HQQ3_Built.exe

windows7-x64

7

8HQQ3_Built.exe

windows10-2004-x64

8

Resubmissions

29-10-2024 00:24

241029-aqgz3a1dqj 10

28-10-2024 23:22

241028-3cw62szekr 10

28-10-2024 23:15

241028-28hg4axmbn 10

28-10-2024 22:33

241028-2grlpawraw 10

28-10-2024 17:43

241028-waj1dasmas 10

28-10-2024 17:02

241028-vj8jnavakm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8HQQ3_Built.exe

  • Size

    6.0MB

  • Sample

    241028-vj8jnavakm

  • MD5

    9a7846d8f9c900f5b842f27558008e13

  • SHA1

    92bcaf61dad392887276c01a572f687da812ec89

  • SHA256

    a9273b79af9041b98d7a4b1638bc314de81193c7d885a0852c9b9c258380a11e

  • SHA512

    e2b1420baced4b6d36ddc04e5bfd4c08d44bd89607094927552b293696888f9bf140fce66a264a02c98505cf40d545a27579fbe256351f716f24cebec917e90d

  • SSDEEP

    98304:K5EtdFBCIrcsamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R9OLPNxkB+n6A:KYFIIrcNeN/FJMIDJf0gsAGK4R4LPNgS

Score
10/10
blankgrabberexecutionupx

Malware Config

Targets

    • Target

      8HQQ3_Built.exe

    • Size

      6.0MB

    • MD5

      9a7846d8f9c900f5b842f27558008e13

    • SHA1

      92bcaf61dad392887276c01a572f687da812ec89

    • SHA256

      a9273b79af9041b98d7a4b1638bc314de81193c7d885a0852c9b9c258380a11e

    • SHA512

      e2b1420baced4b6d36ddc04e5bfd4c08d44bd89607094927552b293696888f9bf140fce66a264a02c98505cf40d545a27579fbe256351f716f24cebec917e90d

    • SSDEEP

      98304:K5EtdFBCIrcsamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R9OLPNxkB+n6A:KYFIIrcNeN/FJMIDJf0gsAGK4R4LPNgS

    Score
    8/10
    upxexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks