Overview

overview

10

Static

static

1

EaseUS Par...or.exe

windows7-x64

10

EaseUS Par...or.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EaseUS Partition Master Activator.exe

  • Size

    2.2MB

  • Sample

    230309-y4x57sab36

  • MD5

    1fb1048f4896328ee4e6da176c94a5df

  • SHA1

    5775e2918e3850bd54c31a017dfc06e4fd847038

  • SHA256

    b1be91e9a72f94064ebe43fa46a4a8ced18c79d7a9e568c5402a0b527c65f1d2

  • SHA512

    9b755b32222bbdeb1870768659c2d0d09dd3d5c70c82486e695079420cd54e1194859f60647c763186077a95466af3f5830c0c0f10de0953e4e200865fd6c101

  • SSDEEP

    49152:dJ4gV9CC+ABH/dfBrDjLSQCKp88CYpQeRRgTH/dvDDJrCG:dJ48+8HVfBrf/3p1DlkHt/Bp

Score
10/10
pseudomanuscryptloaderspywarestealerupx

Malware Config

Targets

    • Target

      EaseUS Partition Master Activator.exe

    • Size

      2.2MB

    • MD5

      1fb1048f4896328ee4e6da176c94a5df

    • SHA1

      5775e2918e3850bd54c31a017dfc06e4fd847038

    • SHA256

      b1be91e9a72f94064ebe43fa46a4a8ced18c79d7a9e568c5402a0b527c65f1d2

    • SHA512

      9b755b32222bbdeb1870768659c2d0d09dd3d5c70c82486e695079420cd54e1194859f60647c763186077a95466af3f5830c0c0f10de0953e4e200865fd6c101

    • SSDEEP

      49152:dJ4gV9CC+ABH/dfBrDjLSQCKp88CYpQeRRgTH/dvDDJrCG:dJ48+8HVfBrf/3p1DlkHt/Bp

    Score
    10/10
    pseudomanuscryptloaderupxspywarestealer

    • Detects PseudoManuscrypt payload

      loader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • PseudoManuscrypt

      PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

      loaderpseudomanuscrypt

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks