Overview

overview

8

Static

static

7

7b73a4d482...08.exe

windows7-x64

8

7b73a4d482...08.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b73a4d4823b27edf938be09bfe3617281a4da1d2f4cf98229092d0b836e6d08

  • Size

    506KB

  • Sample

    250329-drhjrsw1bx

  • MD5

    e02547a2ae9e62889ec6994eb621ce29

  • SHA1

    3417689d0ed68b7d84c0aa37d01f128017abdb88

  • SHA256

    7b73a4d4823b27edf938be09bfe3617281a4da1d2f4cf98229092d0b836e6d08

  • SHA512

    539043099d4587d9abffb6a0893fc37b98b3a668d2fb251353b4e627c9d7a2cbecc258a4bd1b6878a30e8f3c901b911f539011239e56cfe74d03a06aa886418d

  • SSDEEP

    12288:S2FkAeX6GAbFwHwdPZ46pITHy+fPrFoQnm9Yqw72FYGaEQGjl8XHhlGR:Rm56iIPZhITLPh+F5KXW

Score
8/10
discoveryvmprotect

Malware Config

Targets

    • Target

      7b73a4d4823b27edf938be09bfe3617281a4da1d2f4cf98229092d0b836e6d08

    • Size

      506KB

    • MD5

      e02547a2ae9e62889ec6994eb621ce29

    • SHA1

      3417689d0ed68b7d84c0aa37d01f128017abdb88

    • SHA256

      7b73a4d4823b27edf938be09bfe3617281a4da1d2f4cf98229092d0b836e6d08

    • SHA512

      539043099d4587d9abffb6a0893fc37b98b3a668d2fb251353b4e627c9d7a2cbecc258a4bd1b6878a30e8f3c901b911f539011239e56cfe74d03a06aa886418d

    • SSDEEP

      12288:S2FkAeX6GAbFwHwdPZ46pITHy+fPrFoQnm9Yqw72FYGaEQGjl8XHhlGR:Rm56iIPZhITLPh+F5KXW

    Score
    8/10
    discoveryvmprotect

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks