General

  • Target

    CristalixLauncher-3.0.145.exe

  • Size

    4.3MB

  • Sample

    210825-gefwaw6jd2

  • MD5

    25b608146d97e46e5cb8d5d4a77440c5

  • SHA1

    ed5d75d64744a971a7bdb79ba68f4eb0aa7d2cab

  • SHA256

    8504825018e604414d2ebb1093cf249c2f1d56125f6f33a20b071d6a008b8dd9

  • SHA512

    3ae601c91d804c4d6c402ba73263e5749fafdfe35d68d510dc3b632a85d897bb1dc0e48dee4710deaea5932bcf34deb9ca13d4c0c664848abca0372190fb38b9

Malware Config

Targets

    • Target

      CristalixLauncher-3.0.145.exe

    • Size

      4.3MB

    • MD5

      25b608146d97e46e5cb8d5d4a77440c5

    • SHA1

      ed5d75d64744a971a7bdb79ba68f4eb0aa7d2cab

    • SHA256

      8504825018e604414d2ebb1093cf249c2f1d56125f6f33a20b071d6a008b8dd9

    • SHA512

      3ae601c91d804c4d6c402ba73263e5749fafdfe35d68d510dc3b632a85d897bb1dc0e48dee4710deaea5932bcf34deb9ca13d4c0c664848abca0372190fb38b9

    • Registers COM server for autorun

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

3
T1112

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

4
T1082

Tasks