General
- Target botnetc2.rar
- Size 10.0MB
- Sample260807-cdhf6sem4y
- SHA256 2fe9414ac8f5a460243c068cf04bfbbc155eaaaa96c2ca74b50c37d96417c73e
Malware Config
Targets
-
- Target botnetc2.rar
- Size 10.0MB
- SHA256 2fe9414ac8f5a460243c068cf04bfbbc155eaaaa96c2ca74b50c37d96417c73e
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target botnetc2.exe
- Size 20.0MB
- SHA256 4f4ca7a9fd78b4405e0e53b517ba381d21b9da5b6f21409b0222806cf593d13d
Score10/10-
Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target �q �W�l.pyc
- Size 1KB
- SHA256 92b5550576e8b47d232123f907537a8cc6f13676e6438dfbf9224021e29e1821
Score1/10 -
- Target readme.txt
- Size 628B
- SHA256 037ad67f75655e0c681f706968692ed4dca28fc6999c50cda8d6d2f66c442e4d
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1