General

  • Target

    dusers.exe

  • Size

    207KB

  • Sample

    220522-f254xsffg3

  • MD5

    80adc9e5666a4b94fe1637f92d0611b0

  • SHA1

    478bb364184d882005d0503c91a9929d81e89765

  • SHA256

    eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143

  • SHA512

    f7eac083f93f5022d8a580303a16c1e12532f6c0dc89e338eb7585d5233c52f39fa7b3e06c06511e6dc68e398151be30074346e66eaccb972f1c497a893d88de

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Macromedia\index.html

Ransom Note
Services SSD Web Hosting SSD Windows Hosting SSD VPS Servers Virtual Private Networks FREE Dynamic DNS Premium Dynamic DNS DNS Hosting Domains SSL Certificate Company Our Company Contact Us Privacy Policy Terms of Service Service Agreement Help Support Knowledgebase Your Account Coupons VPN Video Tutorials VPN DNS Dynamic DNS DNS Hosting DNS for Businesses Domains SSL VPS Hosting Shared Linux Hosting Shared Windows Hosting Login Great Deals On KVM SSD VPS, cPanel Shared Web Hosting & Virtual Private Network 20% offer Coupon code Get Started Now Instantly Deploy your Virtual Private Server (SSD) Los Angeles, Denver, Chicago, and Amsterdam Starting at $10/month Get Started Browse Safely Online Hide your IP address and encrypt your connection Setup in Minutes! Starting at $3.33/month Join Now SSD Fast Shared Hosting Available Instantly with cPanel Starting at $60/year Get Started Windows Shared SSD Hosting Plesk Control Panel and Unlimited Resources Starting at $70/year Get Started Register your domain with Free DNS hosting .com .org .net .info .us .biz TLDs starting at $15 Get Started Secure your website with GeoTRUST and Comodo Starting at $13.95/year Get Started Geographically diverse service locations Los Angeles, Denver, Chicago, and Amsterdam The Fastest and Most Reliable Dynamic DNS Map a dynamic IP address to an easy-to-remember subdomain. Claim Your Free DNS Join more than 100,000 Happy Customers Linux Web Hosting Available instantly, lightning-fast performance, unlimited bandwidth Get Started Virtual Private Network Join the only VPN that protects your security, privacy, and freedom. Join Now Windows Web Hosting Parallels Plesk control panel, lightning-fast SSD drives, unlimited bandwidth. Get Started VPS Hosting SolusVM control panel, lightning-fast SSD drives, guaranteed resources. Get Started We accept credit cards, Bitcoin, and PayPal 24x7x365 Support 99.9% Uptime Guarantee Free Online Site Builder 30 Day Money Back Guarantee Copyright © 2020 ChangeIP, Inc. Company Our Story Privacy Policy Terms of Service Service Agreement DNS FREE Dynamic DNS Premium Dynamic DNS DNS Hosting Domains SSL Certificate Hosting SSD Web Hosting SSD VPS Servers Virtual Private Network Help Coupons VPN Video Tutorials Social (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-90812209-1', 'auto'); ga('send', 'pageview'); (function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',intercomSettings);}else{var d=document;var i=function(){i.c(arguments)};i.q=[];i.c=function(args){i.q.push(args)};w.Intercom=i;function l(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/aeh7d16f';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s,x);}if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})()

Targets

    • Target

      dusers.exe

    • Size

      207KB

    • MD5

      80adc9e5666a4b94fe1637f92d0611b0

    • SHA1

      478bb364184d882005d0503c91a9929d81e89765

    • SHA256

      eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143

    • SHA512

      f7eac083f93f5022d8a580303a16c1e12532f6c0dc89e338eb7585d5233c52f39fa7b3e06c06511e6dc68e398151be30074346e66eaccb972f1c497a893d88de

    • suricata: ET MALWARE BePush/Kilim payload retrieval

      suricata: ET MALWARE BePush/Kilim payload retrieval

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks