General
- Target drp-cmd.7z
- Size 12.3MB
- Sample260716-w487csft51
- SHA256 c613097e837f3d90d122f66f25766de045b6ba8922b751903ff2dc650421cb14
Score
8/10
Malware Config
Targets
-
- Target 7za.dll
- Size 272KB
- SHA256 d7f1224cc4afb90af3792dadfdf2f14bad4a19329ee0f3c87c111611aa36b7b1
Score3/10 -
- Target 7za.exe
- Size 796KB
- SHA256 ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
Score3/10 -
- Target 7zxa.dll
- Size 161KB
- SHA256 6b4888207c46c23d2d4e4eace8a2db01711692bc7d4bb93f3750bc41e91bb73c
Score3/10 -
- Target start.cmd
- Size 86B
- SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1