Resubmissions

20-10-2021 15:46

211020-s7r6gahcc5 10

20-10-2021 15:32

211020-sy5p7shca9 10

General

  • Target

    OpenSea-App_v2.1-setup.exe

  • Size

    116.4MB

  • Sample

    211020-s7r6gahcc5

  • MD5

    b188206887e0f25a50c50e1955413442

  • SHA1

    3f4fcd1debd12586f712d694218339a7fd40c50b

  • SHA256

    de644e637da7cd117517b1bb96ee0f58131515013a322366d680f613afa31bc4

  • SHA512

    94391442364c2e6a16a2fd0bd2384d0f21a56cd5a67faa7998511ebb55feb3e5a7915c603c2caaa8da79f8bdfc1490eb2a8f559546193977b239a2d133bf3624

Malware Config

Targets

    • Target

      OpenSea-App_v2.1-setup.exe

    • Size

      116.4MB

    • MD5

      b188206887e0f25a50c50e1955413442

    • SHA1

      3f4fcd1debd12586f712d694218339a7fd40c50b

    • SHA256

      de644e637da7cd117517b1bb96ee0f58131515013a322366d680f613afa31bc4

    • SHA512

      94391442364c2e6a16a2fd0bd2384d0f21a56cd5a67faa7998511ebb55feb3e5a7915c603c2caaa8da79f8bdfc1490eb2a8f559546193977b239a2d133bf3624

    • Registers COM server for autorun

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Tasks