General

  • Target

    IDM Portable.zip

  • Size

    13.9MB

  • Sample

    221129-xdytdaeh32

  • MD5

    844756b2edd52b82f1ff9dd44917d63c

  • SHA1

    709332977223c602b9e2ef60a1f882be1e112acc

  • SHA256

    edd2dca39f2c16c0e5ac08a905d4420759c32a2da3d254396940e9eee3480696

  • SHA512

    d7c5ead166d77b069d3d1e1abdb57d89c0a8838ab3974f75c8b527b47f062b3d655ffb2c24129d1f0d6229815b363ce5007396592dffc5860cae1329bf2a0fbe

  • SSDEEP

    393216:COyKFJmi4S1toncDwe6DkKj/QWDjYzdGdtJqV/waAtvbVKB:COvFJm3S1Z/8tDjGYtJqtNA5o

Malware Config

Targets

    • Target

      InternetDownloadManagerPortable.exe

    • Size

      71KB

    • MD5

      1d9b7bb85e74cabafaac8baf2fc3db99

    • SHA1

      c14e9a55a308b92bc4631e8aed3a24d34801bebc

    • SHA256

      c1dbfcd749baa5a588e5ecc9cd05c14b6d224b7c0867117c519f9f1ea13811e0

    • SHA512

      2a433f0ff84ba48676957ddc253df4d26d1c17b95f6928320758758af91bf6e85e31112b1370ce9d5d2768689998be915b3879b421266ff3deb5cc1267eb2099

    • SSDEEP

      1536:YdnREfs9ke7FggdycW64fUX808MRwadzJaAwo+zo:YdRGsvFggQcWhcX8swa94Awo+zo

    • Drops file in Drivers directory

    • Registers COM server for autorun

    • Sets service image path in registry

    • Loads dropped DLL

    • Adds Run key to start application

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

3
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

4
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Tasks