Overview

overview

3

Static

static

_26FED086E...2.html

windows7-x64

1

_26FED086E...2.html

windows10-2004-x64

1

_41A9F2838...7E.gif

windows7-x64

1

_41A9F2838...7E.gif

windows10-2004-x64

1

_44D2A7158...51.gif

windows7-x64

1

_44D2A7158...51.gif

windows10-2004-x64

1

_478F7B0DE...FE.gif

windows7-x64

1

_478F7B0DE...FE.gif

windows10-2004-x64

1

_4AC53E452...F5.xml

windows7-x64

1

_4AC53E452...F5.xml

windows10-2004-x64

1

_5B1FA3360...09.gif

windows7-x64

1

_5B1FA3360...09.gif

windows10-2004-x64

1

_6CFB3B604...14.gif

windows7-x64

1

_6CFB3B604...14.gif

windows10-2004-x64

1

_777A5F8A6...30.gif

windows7-x64

1

_777A5F8A6...30.gif

windows10-2004-x64

1

_CE5482E8E...08.jpg

windows7-x64

3

_CE5482E8E...08.jpg

windows10-2004-x64

3

_D32A93A0B...3F.jpg

windows7-x64

3

_D32A93A0B...3F.jpg

windows10-2004-x64

3

_D60D95134...AC.gif

windows7-x64

1

_D60D95134...AC.gif

windows10-2004-x64

1

_ispmres.dll

windows7-x64

1

_ispmres.dll

windows10-2004-x64

1

_isusres.dll

windows7-x64

1

_isusres.dll

windows10-2004-x64

1

agent.exe

windows7-x64

1

agent.exe

windows10-2004-x64

1

dwusplay.dll

windows7-x64

1

dwusplay.dll

windows10-2004-x64

1

dwusplay.exe

windows7-x64

1

dwusplay.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adf08f8d41920c087cefcfcffdcf2058fd0b75a64f8e66a4215c58a4851661ee

  • Size

    997KB

  • Sample

    221001-193c8ahhf2

  • MD5

    62465f49129b32a32180f75d58fdb990

  • SHA1

    fe63a4225ae5d7a2f769a039c4c4e1899ac4f4f3

  • SHA256

    adf08f8d41920c087cefcfcffdcf2058fd0b75a64f8e66a4215c58a4851661ee

  • SHA512

    8e6196f286a506b7a14e138a09e57fec4614812b87bb06a2d2688ce6db489564665856df810d973e9a9543698c9d7d9645ec293bf0395b52f2d898197e1b85e9

  • SSDEEP

    24576:ft5ZtMdyUSDUk9kwFT3Z2Cnf0YSDh8mK1PfyAizAfGgrW:Fjt0yHDx9FFZ2mMYCmmKtyAiRgq

Score
3/10

Malware Config

Targets

    • Target

      _26FED086EE6F476286FE08B8EBEB10E2.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      4KB

    • MD5

      830803180d49daa78e398075bc23bc4b

    • SHA1

      7db2a13c8d4673f29dc8ff17b01e89abec9d6ce7

    • SHA256

      b43208c686e5df15108466a6cc5de47a0878b755f29ae55942f6dd609c9ec4e0

    • SHA512

      c04c5e8e417894d91d68bfae2c2dedd0ea084fcc9b94feafadf4e0d2a6667dc182801434a96c16380e1bcc3dc708381f91e8b9e5c6567e79d4383ecc5a345b0b

    • SSDEEP

      96:nRI6vyFzCL8O1XIkyef3HWCLhrXI8dddddddlfjsYCkWdddd5GUxgnDgSxglvMdE:RXyhCL8O1XIk5f32CL1XIufYYCk+GUx/

    Score
    1/10
    behavioral1behavioral2

    • Target

      _41A9F28384324FDE91E7871F0181B27E.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      961B

    • MD5

      305fee16f0e789565bd29496e1d852a7

    • SHA1

      2b1dfa28edb1c5849c6f98265d018e9893eacdca

    • SHA256

      fb872edcdab4be97fd81bccb14c669011bcf6216fa5ae71baad4575359c8cb29

    • SHA512

      5b5be0a3bd8444b94f5d4252fe73d2c473d039451b00980020dc1bd556d059a4211a90977a3cdfe6b84fa63df807900bbc240376e419c0f5cb877937bad11c99

    Score
    1/10
    behavioral3behavioral4

    • Target

      _44D2A71587174CBDB18E3449B074D151.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      43B

    • MD5

      325472601571f31e1bf00674c368d335

    • SHA1

      2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

    • SHA256

      b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

    • SHA512

      717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

    Score
    1/10
    behavioral5behavioral6

    • Target

      _478F7B0DE6CB4C3D9433AE04DB76FFFE.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      7KB

    • MD5

      77f7548c859d335749ff2bdf350aa613

    • SHA1

      c2764b9dd05be1c2ec9118e8b6b33240d17ed552

    • SHA256

      d03aae703c8dea4980f388fb8d5d9c43ea6e7b3b3345131bd5b6f28cf7fbe8df

    • SHA512

      9d36c8563d8a3add3f257a0a208d0d396f46c5d4a3e4bd35c539a8199644ac31e73fa41cc898cfa171bb8f4e91f840a98092732d2e59fd2f3a2d11becef0eb89

    • SSDEEP

      192:2JgNFthx3IeqUFSDWxV12ZUK7wzT2g+0bowub:fNFBMUgKxD2Z97wziPXb

    Score
    1/10
    behavioral7behavioral8

    • Target

      _4AC53E4526F043C487397FB240D97FF5.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      586B

    • MD5

      f6edf9703c2b936f96324dc366e19c22

    • SHA1

      21edc9aeda8d46d68de2aa346122b08e487df017

    • SHA256

      e350b8ab1bfb8f971b053dd2e5dcc53ccb22895dcfe1cda451dca3fec8f64e62

    • SHA512

      b4c184a19bf69ebcc281f85eb088e5261275f96b507114525752eafe565c324feb2ffbdca3f2f513bc163982563e8bd80b545b607ac554a9d3d6ab1e88bf9860

    Score
    1/10
    behavioral9behavioral10

    • Target

      _5B1FA3360FE84FFDB21EB80014410B09.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      7KB

    • MD5

      8e102a063f1fd95c10b507406226aa3d

    • SHA1

      823d5b4b49b1046479e89d7a76652f0418f11dfa

    • SHA256

      63db9a5eaa2e47e044ae385ba45c3d1f09c0726d00ceddc16ddd746e29849971

    • SHA512

      2b637458566b5829815003d968dcce64d1e83ecd3e4a58c16e73a3fa4d8217ebf71749101429b450575975bcb42a396512201f0a9ec299dceff60a5c0d564f9d

    • SSDEEP

      192:sJuNFthxOc61LhmgRg6oFpyBE5n1yER5jG0be2d3cVwBavbESYzO:7NFMcm9mgJri5n1yMle2d3OYav4RC

    Score
    1/10
    behavioral11behavioral12

    • Target

      _6CFB3B60424643FBB8BD1865C7D8E914.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      7KB

    • MD5

      2ef697b511d638aca0ec387ff8542a90

    • SHA1

      18c890044fe277bc1aa3ea95fb9d24950cb009eb

    • SHA256

      3b748ccb5cc55f08e4df2a448fe53e83c9e728d4b238d3079e416b8d4115b96a

    • SHA512

      dd159b244c25d42cd3695db6a2d06d09cb4aa2f243eb28d1807d9986d83301cf7adfb4ad02046af28f28668873adbc4b8daf509e4d9dfe2ec8b3ad2140d63589

    • SSDEEP

      192:3z7PJYUrUH1si66Eprmi385BhzgqV/ryALUnw008TRO:DZrUH1sHrP3MNVTyALUndxTRO

    Score
    1/10
    behavioral13behavioral14

    • Target

      _777A5F8A6F9848F493C65A5ECB485E30.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      987B

    • MD5

      8523b43a08fa6df6aefd1a33318e9ea6

    • SHA1

      3eff6b11ffaa25187fe06eadb0a3a3bbb45e3bab

    • SHA256

      1af52c3f59366bd24afa1974de07d8b3f3a5335d54da7e4719b562ab52bdfa30

    • SHA512

      0edc7f3ae943c37f90d1908078eb4b9d6b35f1d27c8331de7c11216bbc55d336ee2ecad77e2a0808729532b1e479442dfb9303d83893fd42e855a3ed0f4e2e26

    Score
    1/10
    behavioral15behavioral16

    • Target

      _CE5482E8E7C047979604D3B32BF91F08.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      24KB

    • MD5

      b352968baa74c515fcd40c00fc9741c9

    • SHA1

      dcc7413374dfcbc01265824b5dd223db87e05e08

    • SHA256

      df7c6de718834ddef8bf722630004341b2fe5fe65a0d675a1fe9ee9fe0250d9d

    • SHA512

      a0ffc07b6ec7c5968f2059ac196227021da4e77157585c88a4344f1737deb528746660d07e13253be30c9840f276a45ec5ee15f624f2fa307770b84641cdea22

    • SSDEEP

      384:WWWWWWWWWWWWWWWWWWWWWWWWWWWWl6vFRP155YB5P5Ku7TNPq7jmDJrLsn+kxDe:oMqXmVrLs+k8

    Score
    3/10
    behavioral17behavioral18

    • Target

      _D32A93A0B5AC4EF5B890A1F372EFB13F.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      18KB

    • MD5

      5c321614c6ddaa99aa00421356732f7f

    • SHA1

      718259130a149be599983b1c07572ef996c25c45

    • SHA256

      478a4b2c1c477a7f60c39e153008fc13d50a82871c411916faf77f8e4cfab608

    • SHA512

      e2ece741b89fc32a3ffa5981cc553aa88d398188a659ee8b1d57b6e723420760f9c42f692f9796b2e211d3f5ff2d48a98b088440d1751cf585c4ddf63092fc75

    • SSDEEP

      192:33kq2XL1wHUHA4g6/jZt2t2t2t2Zc6t2ZR9yZEu+8QnnnpcQteb8p6L06L0t:30q2XL1wHUg4gppyy8ecoe4gLK

    Score
    3/10
    behavioral19behavioral20

    • Target

      _D60D95134F664F95878A416B8E57A9AC.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      5KB

    • MD5

      56be2d3b6b26ed86bd3c03b313ba7af8

    • SHA1

      d114436224776d14e39ad42728084ed4caf66fa8

    • SHA256

      73c74ca5d2aa8eae0951a2f8dfec3e1d77bb1e437a778f77b3aa61c7a08067d8

    • SHA512

      49d980ba9629fff1e4a7d4a786d77cdb0aa92c4e8bde21912cde0bd54eb06bf9bdec89b5aaea58e947e12c9ce33fd72dcb809e6626236d917d9c3494fbb7d017

    • SSDEEP

      96:h6WkqipbEwQg824ZxzZlhuyjtBVffSxlrORgtfkVLb1lyGrtxSSkptqKmP/GzWKN:h6Wliujx5xzZTuKffUrYgqx1MGO9LmH4

    Score
    1/10
    behavioral21behavioral22

    • Target

      _ispmres.dll.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      376KB

    • MD5

      e4ac9c29a423739c22c1c593a4cbdef5

    • SHA1

      e9e3b243a9e9ab53b29542c470488526f559af23

    • SHA256

      553527cf293ff67a49cb0835d3dfcd6eee21da2c26e82fa41b4dd4624fe90480

    • SHA512

      dd1efba182f2f46b9cbca61623a2c9bea59611a8725d9e13c587e3a43d0e4b250e31a9c7c9c4875d8845ea0f0b180f0ac67ebcfcc142d980c2c7e2db910bfc2e

    • SSDEEP

      3072:78kTofTvJlhHfDXKhpr/HhJgLkQunWSZjmX789JzevfTro68RnDe1sW4zooxQXG7:m4zoNFQ

    Score
    1/10
    behavioral23behavioral24

    • Target

      _isusres.dll.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      360KB

    • MD5

      084f5de83aa862c2b9bea9ea353dbef7

    • SHA1

      d014118c93d7effdb2c8eb37c60c00051025f25c

    • SHA256

      7b139c7ed2bdea93c864b0f528f58914555df740c72947da90e576aa6a876250

    • SHA512

      41965b128797e6fc8c3435fac769f96f1aa2aae9ecfd9ebbcf76310024893c84b053f517d5aa692eeabc3e63dc456d4cb9775a0321cc5079b27e4d9d7fca2882

    • SSDEEP

      3072:zkz/sXkXZP9wrr/UNf7hL0nyvAgnNdFcz0jkbhutCHKnX8SCdFrcwBwDSgav5X/Y:Mg/UNuncvvtCHKnX8SaBwDZ

    Score
    1/10
    behavioral25behavioral26

    • Target

      agent.exe.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      568KB

    • MD5

      b738c9eb50a94d22a0259b340a97b8a4

    • SHA1

      be1cb158069ae9e86c4b607ce6ecb8ba4d760854

    • SHA256

      3a840822c489a19a3d2adacb76bc1488ac73d4b7f50681075349fdeb7b84bfa9

    • SHA512

      9c71ba923d7f1d5326eda300e26a06761047e3c73615ee3ed8b5bbf49c3fc9a1c3e8974356aadd2814e7a71ff7005e84993782fe7eb25b1d4ce2252f61f8757e

    • SSDEEP

      6144:4fPG/hCegFJ53jOWDlbURCHGD8yAxo+6eBP1j4m9v6pD0gbSxB7qWWRl:iecjO+UROeAxo+6e0A7Dn7

    Score
    1/10
    behavioral27behavioral28

    • Target

      dwusplay.dll.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      24KB

    • MD5

      3fea9d2edf23b0283c7a66c8dea380bd

    • SHA1

      6b18a6e3033fe8fdde7a26d47e62ddcd8aaf18a5

    • SHA256

      a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18

    • SHA512

      0985f6b1f410a8440a45882a5bebc08b1538b52a3eeedaa21a736692d3d3fca2dbba05992a7643f2bde2540e31d87d28bf0ed07fc6a785eee5cc461c0b872bf1

    • SSDEEP

      48:SdrllOC21BEM8ipPI7eOrdwzwnAceVt1FiwVO1nN0wdm6Hn:44BR8ip5OrdwQAc8fW1Zbn

    Score
    1/10
    behavioral29behavioral30

    • Target

      dwusplay.exe.C3A146F5_4B48_11D5_A819_00B0D0428C0C

    • Size

      192KB

    • MD5

      cdbe35ea59bc9223e4f800bd1db82d27

    • SHA1

      5480f879d07abce426284708dbb0c9dba4a4ee67

    • SHA256

      bae62e810f7aff638d1ceeee9de2938335361d06b7804bda3b9612d5f1f1b704

    • SHA512

      f0294eca99c3ffad9ff94bc36b68a07aeda8c550da9dee615d9ef40f0a28814d246a6136ba2282e7c37d85ddc01db416b9ffbbc8278629a18b092dc1f58b30e5

    • SSDEEP

      3072:LIz12fszBCh09V3RWQYo4eI3OU7c934+SvjqgZOGJcKUEgqqpC:LIcUBucWQYgI3x7c93ovjqgU1Ex

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v6

Tasks