Overview

overview

10

Static

static

10

QhtbqjQkwerkQM.exe

windows10-2004-x64

8

Resubmissions

29-10-2024 18:27

241029-w33m7ayakj 10

29-10-2024 18:16

241029-wwq1tawqft 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QhtbqjQkwerkQM.exe

  • Size

    9.4MB

  • Sample

    241029-w33m7ayakj

  • MD5

    3058d08d8d69deae85ded336f0d634e8

  • SHA1

    e729a30da097e8d3f2a9da410f00c3a6c517dd8e

  • SHA256

    4b7bd823a8689239505d1c056beee701eb575e1b7e6f43aa17878365e805e29a

  • SHA512

    5cbd1f670e876d8f2627a26802a9d84a96b5401b6cc3850bf019c254182b09be891d26cc847399071cf897e745db02c323960aec625d179648fb837f8c4ea361

  • SSDEEP

    196608:Fw0113cumcMIXdZeNTfm/pf+xk4dWRpmrbW3jmrx:n3cEky/pWu4kRpmrbmyrx

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      QhtbqjQkwerkQM.exe

    • Size

      9.4MB

    • MD5

      3058d08d8d69deae85ded336f0d634e8

    • SHA1

      e729a30da097e8d3f2a9da410f00c3a6c517dd8e

    • SHA256

      4b7bd823a8689239505d1c056beee701eb575e1b7e6f43aa17878365e805e29a

    • SHA512

      5cbd1f670e876d8f2627a26802a9d84a96b5401b6cc3850bf019c254182b09be891d26cc847399071cf897e745db02c323960aec625d179648fb837f8c4ea361

    • SSDEEP

      196608:Fw0113cumcMIXdZeNTfm/pf+xk4dWRpmrbW3jmrx:n3cEky/pWu4kRpmrbmyrx

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks