Overview

overview

10

Static

static

10

Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    7.6MB

  • Sample

    250107-x42b7awrgr

  • MD5

    47952e919d93abec76cfea774e1f1373

  • SHA1

    68d9f271dcdeed4f14d07a0652fc5b9889bb3974

  • SHA256

    d15e40451200e749ff7ad48a9944ff3f9c6b884af740d6bd855c99c1be438a99

  • SHA512

    23be37f4d1feed9f91cf9fccba46f9ac38e96effa5b854a73ce2fe01a3b4c5153d13719e39a9a038dcdd422f6a04ac7d57117c42b5b204a273606f04598491e7

  • SSDEEP

    196608:2xD+kd0wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWG:U5JIHL7HmBYXrYoaUNN

Score
10/10
blankgrabberdiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      7.6MB

    • MD5

      47952e919d93abec76cfea774e1f1373

    • SHA1

      68d9f271dcdeed4f14d07a0652fc5b9889bb3974

    • SHA256

      d15e40451200e749ff7ad48a9944ff3f9c6b884af740d6bd855c99c1be438a99

    • SHA512

      23be37f4d1feed9f91cf9fccba46f9ac38e96effa5b854a73ce2fe01a3b4c5153d13719e39a9a038dcdd422f6a04ac7d57117c42b5b204a273606f04598491e7

    • SSDEEP

      196608:2xD+kd0wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWG:U5JIHL7HmBYXrYoaUNN

    Score
    8/10
    discoveryexecutionpersistenceprivilege_escalationupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks