Overview

overview

8

Static

static

8

94fff12775...ab.exe

windows7_x64

8

94fff12775...ab.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab

  • Size

    197KB

  • Sample

    210131-r4ntybl15j

  • MD5

    039ce25d495fa555ae1c210592b564d0

  • SHA1

    6684d0ffde174052a03931981262dc0a7cb9891c

  • SHA256

    94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab

  • SHA512

    c2be8d6b80e57339957f370b4ac31bd03140f9a9ed4865926eb6d7e5a69d3510b046930c1933d38629b4c3bcae007b6cf5e6140463ab6e064820cdd91bbd46bb

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab

    • Size

      197KB

    • MD5

      039ce25d495fa555ae1c210592b564d0

    • SHA1

      6684d0ffde174052a03931981262dc0a7cb9891c

    • SHA256

      94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab

    • SHA512

      c2be8d6b80e57339957f370b4ac31bd03140f9a9ed4865926eb6d7e5a69d3510b046930c1933d38629b4c3bcae007b6cf5e6140463ab6e064820cdd91bbd46bb

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks