Overview

overview

8

Static

static

1

mmc-develop-win32.zip

windows7-x64

1

mmc-develop-win32.zip

windows10-2004-x64

1

MultiMC/MultiMC.exe

windows7-x64

1

MultiMC/MultiMC.exe

windows10-2004-x64

8

MultiMC/Qt5Core.dll

windows7-x64

3

MultiMC/Qt5Core.dll

windows10-2004-x64

3

MultiMC/Qt5Gui.dll

windows7-x64

3

MultiMC/Qt5Gui.dll

windows10-2004-x64

3

MultiMC/Qt...rk.dll

windows7-x64

3

MultiMC/Qt...rk.dll

windows10-2004-x64

3

MultiMC/Qt5Svg.dll

windows7-x64

3

MultiMC/Qt5Svg.dll

windows10-2004-x64

3

MultiMC/Qt...ts.dll

windows7-x64

3

MultiMC/Qt...ts.dll

windows10-2004-x64

3

MultiMC/Qt5Xml.dll

windows7-x64

3

MultiMC/Qt5Xml.dll

windows10-2004-x64

3

MultiMC/ic...on.dll

windows7-x64

1

MultiMC/ic...on.dll

windows10-2004-x64

1

MultiMC/im...if.dll

windows7-x64

1

MultiMC/im...if.dll

windows10-2004-x64

1

MultiMC/im...ns.dll

windows7-x64

1

MultiMC/im...ns.dll

windows10-2004-x64

1

MultiMC/im...co.dll

windows7-x64

1

MultiMC/im...co.dll

windows10-2004-x64

1

MultiMC/im...eg.dll

windows7-x64

1

MultiMC/im...eg.dll

windows10-2004-x64

1

MultiMC/im...vg.dll

windows7-x64

1

MultiMC/im...vg.dll

windows10-2004-x64

1

MultiMC/im...mp.dll

windows7-x64

1

MultiMC/im...mp.dll

windows10-2004-x64

1

MultiMC/ja...ck.jar

windows7-x64

1

MultiMC/ja...ck.jar

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mmc-develop-win32.zip

  • Size

    13.5MB

  • Sample

    230320-y37y1sfc43

  • MD5

    745992832e9b94949f51a476add8264b

  • SHA1

    4d11cd2b81cc6c456f29cf44ed54cc911f53c37b

  • SHA256

    8662964a0c03e181d3a7cd58824a4367a4e970f333d693a995af83bada214c05

  • SHA512

    0925c87cc6243741ba7681b39d0173b64137fa2b94a33a82943c4c00c5737910792f6a48b1d1dc00a0e8bf2647447316c002b500d0ebaaa53a758ff678d04706

  • SSDEEP

    393216:Wy/mqGxGVinAqB81lhubAyC6F81qYo9rI:Wy/mHxGq8PhubvP81ql5I

Score
8/10
adwarepersistencestealer

Malware Config

Targets

    • Target

      mmc-develop-win32.zip

    • Size

      13.5MB

    • MD5

      745992832e9b94949f51a476add8264b

    • SHA1

      4d11cd2b81cc6c456f29cf44ed54cc911f53c37b

    • SHA256

      8662964a0c03e181d3a7cd58824a4367a4e970f333d693a995af83bada214c05

    • SHA512

      0925c87cc6243741ba7681b39d0173b64137fa2b94a33a82943c4c00c5737910792f6a48b1d1dc00a0e8bf2647447316c002b500d0ebaaa53a758ff678d04706

    • SSDEEP

      393216:Wy/mqGxGVinAqB81lhubAyC6F81qYo9rI:Wy/mHxGq8PhubvP81ql5I

    Score
    1/10
    behavioral1behavioral2

    • Target

      MultiMC/MultiMC.exe

    • Size

      8.8MB

    • MD5

      38c782c12952ecaeb3af973a7338790d

    • SHA1

      3167c8152fde81d9b3aebbb41d38a607ba5b48b7

    • SHA256

      4fc7abd9769e631fe1831b8b0da7b924322b77fee774dba6c5d0ccf6f69242f4

    • SHA512

      e72b69bee5cf6ca2c45d8b84f128126dd1c81f03e7dfae4d03e3d906f79bb7e1f9ecad6030e4447783657e59c75017df72f590ca786edcfd2996c88345542a1a

    • SSDEEP

      196608:LjeHzMAqhnF5SdEy/vgiBkxqSdXh9NWompJIwFsBEeVgVvV3rABVLVVkNWV+O8VU:OHOer/vAUpyRVgVvV3rABVLVVkNWV+On

    Score
    8/10
    adwarepersistencestealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      MultiMC/Qt5Core.dll

    • Size

      5.1MB

    • MD5

      9c31c47941edd8aed4bb51a3be9c6ea2

    • SHA1

      e83d8c04fec834086a018f8bff01b614ef6e3341

    • SHA256

      79b83c43af99a9cb72a744ae2262c090227907907e8f2deb937cd4e1f0965e4d

    • SHA512

      9763960a8118ab558e1a26abef275cddb323449608eb4f8518b82fa67d34ffc1d146f4f6b3e072317d8b0af5e95ca84bcdeca838ec150d4b3ef2e748c0a9d961

    • SSDEEP

      98304:paO5O7s0XerbbAJIaKSA31cCvErDsNYWZSgkvDFPJsv6tWKFdu9CQlld0:BOoZX8O1cBdUSg8DNJsv6tWKFdu9CQZ

    Score
    3/10
    behavioral5behavioral6

    • Target

      MultiMC/Qt5Gui.dll

    • Size

      5.4MB

    • MD5

      03e5f50d7848d9cc2d8d00127ea6e706

    • SHA1

      30a5fd241e9db476f11235d7a7d650ec23ac97e2

    • SHA256

      047811d5fecb88e19c6e70aeabac7848599142cfe8aba1a01c0d130dd4f72452

    • SHA512

      d41c80f85cfbe9779cccb3ad3825917044075b126c866aece157c6b85b418382394cb6a58cd5b2ea386659c042fcebe963131fb2d37ee80c684c1c9154eb9e31

    • SSDEEP

      98304:TKTu1y8DX4YFi3UIK5f77kyB1ophScU22BhrwRD7e+1X+Q86o:TPTFbFdYhd86

    Score
    3/10
    behavioral7behavioral8

    • Target

      MultiMC/Qt5Network.dll

    • Size

      1.5MB

    • MD5

      a72dfd36b9b8c51de93f3c7cca5945ce

    • SHA1

      1bb6dfcb892b74968f5b8ef26e0027842df20fbf

    • SHA256

      41fafdcea112cb01edadc0b2c14995d4cf05e4b5fd101a6e196baaa614b228e8

    • SHA512

      5a38b11928f1319dac7b75cfd8304610f75e0464f26bc44810458e14cc79ca9d1396f55c1c6405baf95e176755a50c8076bcf6b30d05e4fc95607f479b9f9dec

    • SSDEEP

      49152:ZrURZC+3uELYy60bMcDrGBj3IfTt3yLorAnjhm:FK0+3uEUy6YMcDrGBz

    Score
    3/10
    behavioral10behavioral9

    • Target

      MultiMC/Qt5Svg.dll

    • Size

      349KB

    • MD5

      96934c8f93716fb4c5ab7433c3fcf660

    • SHA1

      e411016b245b77813f8ea5ed9dc8dcf9403ac831

    • SHA256

      adb44de5a537f5fadb9288e3852189f799ba7b95cef847f2198a8864ab6f063b

    • SHA512

      bcd231289cf4900886a4a5c55c0584073da36d5dd823ebf6a59986932fdb1cf70ead079fcdc7e9cfd4837e6212eb7037a7b5b7b0704e073b06c6fc4f5dbbc97d

    • SSDEEP

      6144:GCJ8N/2aVIOLZS5Qyk2MIwe8x1TB3JJ+Wd5J/LCW2V:GCJQ2arZS2yAG8x1TRjDL

    Score
    3/10
    behavioral11behavioral12

    • Target

      MultiMC/Qt5Widgets.dll

    • Size

      6.2MB

    • MD5

      501d23a2e5e2f8bb1564ac627f674bc0

    • SHA1

      84934fea79b0e4c39afc325b48a3dbc64e6d98ef

    • SHA256

      5c16112f7f7454e2e802f4a18e0b9a9a0086b9ae29bae35892d7d32f3fa81c94

    • SHA512

      9282c422b289309f74c5af8a5b102791057607ea0e35f0bde41a64c4240cae3f1fac921c3271d55fd22e56a9934db6b535c114244a79debcf8185fc4c094163c

    • SSDEEP

      98304:wNL3373gY4y8fcLwtFc94OLHa2QmqfbTI7N6WidvtjPvAsSo+AyNBVmcBNx2hXL/:a+yG+yFisM46BJqgxUVs3Xcu6

    Score
    3/10
    behavioral13behavioral14

    • Target

      MultiMC/Qt5Xml.dll

    • Size

      221KB

    • MD5

      f09bf12746b7821c7ab1e16ce41e9119

    • SHA1

      f70368238133e02957e465ae1196f064da69680b

    • SHA256

      dbdd63614097767943c585c09f08d346500683e308861f583b2589618d491d6a

    • SHA512

      ff3dfbec1efb9dae085da3b38f1f7b3d59c289137bc18c8330a6ae95471eded0569669dbf9eb83ffb3be03803c6eb248f2999b963614c40719bc953138fe85d5

    • SSDEEP

      3072:nn7BwPZm8TEGjKh+NPmuWFaDA1w1Bn6PJQD+B6TQtiPVSe00FUAuDl3DF+bDXW2b:uPdjKhY+uWFaDA1jeu6TQtiPWuPW2

    Score
    3/10
    behavioral15behavioral16

    • Target

      MultiMC/iconengines/qsvgicon.dll

    • Size

      44KB

    • MD5

      cbb708acdbcfd89e1de38e2c4aa9192a

    • SHA1

      c9f658b429391876bbfdf8081b3e90d725bb2307

    • SHA256

      8cb93b212c02fd6d222e985e629df698227323c43b7f0b71be3649aa8cb3cc2f

    • SHA512

      2bd5a12c236ef1da3e8e002850595c101255e519b66a3a75e6f3a12bdebdd67b54b47b08028695eb8c571bc257f7241cce6351d3cf4d3fd4ed1176965eb02e0f

    • SSDEEP

      768:xjf6bXA7t029ZxcVeA69Pz47e8J8J80IHN6n61/KWqYTfbiWS:EM5Oc41WW9ghWxbib

    Score
    1/10
    behavioral17behavioral18

    • Target

      MultiMC/imageformats/qgif.dll

    • Size

      32KB

    • MD5

      67598fc68a992f106bfad56b22cac886

    • SHA1

      9285cea038e0f8f10125ca4b724c264b041f4da6

    • SHA256

      000bbacc0fa451c61413e50b3ef63d3461da422b3425404d8952a52182121b6d

    • SHA512

      04af56c60969090c4d09fc27fbb8c1d794ab4b6dc9ba3eadc842edca7f68788f7880ec0e533b63dde284511a456dee10814824795915ff492ca01e64e7b86429

    • SSDEEP

      384:afrulhh3V/N8pXxdQLwfUOWcE7kX80HBFZuTRpIWvTCCz:yMR8ZE4u7qBEIW2Cz

    Score
    1/10
    behavioral19behavioral20

    • Target

      MultiMC/imageformats/qicns.dll

    • Size

      45KB

    • MD5

      3b48f732f811ea6ea4fcc18808a7df1e

    • SHA1

      f924dbd2a760e8b259582a43a0797bda29b3d06f

    • SHA256

      5da98ac16c329354b1b709b20fcf797f3fbdb8d3e834054568d2ff68e897851d

    • SHA512

      a1c1eff1357be31172bc340c339ccd31dde7285db3fcbd5c10989af743a8936596b8252ffea1b52c6be6ea06f11b3845268f76e52289dc28896dd26ebf9d1c30

    • SSDEEP

      768:naEh/izNdGh+UNit6OT80EyJ4kCsIusIGEWBNdk9:aEhfg/8KJjPmQWBNdk

    Score
    1/10
    behavioral21behavioral22

    • Target

      MultiMC/imageformats/qico.dll

    • Size

      35KB

    • MD5

      2c32188d9388b06ec91170e4461913ab

    • SHA1

      082689789ff54cacf94b0f171c762df512c8a786

    • SHA256

      63f7f73d9bd956ca55b80ce29d24c0a1da1a126885d45473e5779ca78a709dcb

    • SHA512

      57286e87e9a013229db863c152d41b7af821b8afa7f84259f58f7089a947ca3771d526aada88212fcbb235209b6b504a489a5c43c4ba0b2a77e1f31e882e9262

    • SSDEEP

      384:JUev3snLkJqIN1v5dqY3M1lNRa16NQkgcPkRu7xR3xr+i1AxwWTTVqI5SEwZY1:l2XqL0IexWkg0k0dR31fWdqqSEwZY1

    Score
    1/10
    behavioral23behavioral24

    • Target

      MultiMC/imageformats/qjpeg.dll

    • Size

      246KB

    • MD5

      c228c1486e203d48d9c7d84d0b631e15

    • SHA1

      1ccdd75d6cd473d00aa17686ec98f509b1e8e360

    • SHA256

      a55cb801a07932d263c980b14abdb464acd8150b9258260efdf535634bfe9811

    • SHA512

      a649078738e69572276a37431c495582f933b04701deded8b5f6dd5b3c6d5b9d338ddb242b71659038d324ca74c2a8f2b229c7beba6f16ddea238f2bcbfae870

    • SSDEEP

      6144:jutAUtpjvlyaX8XZ99bkBRSMArBPkfB917Wu:jutAavlqJMArBPkf

    Score
    1/10
    behavioral25behavioral26

    • Target

      MultiMC/imageformats/qsvg.dll

    • Size

      28KB

    • MD5

      7eb5b428de2fd5ce7f361bbf3d6aada4

    • SHA1

      318acc5132492347727bde7ed70516150144b140

    • SHA256

      c818b37d77c84e3a9963a761bae3eefc73cccd3485ee6cb1c085c670041e9c59

    • SHA512

      681fb8a700aee5f44cf1f328c2fea157a98dab12e287f686d408584b5096ac262cb5cd2b2ff1f3c1b6e55d374ade2236118f41ec9c14fbec7014aae0683c1e5d

    • SSDEEP

      384:0F2Z2Eg8ESscKYkiluz0RdysDv2IWsTmqK5J5:SqESTnDRbWH1J

    Score
    1/10
    behavioral27behavioral28

    • Target

      MultiMC/imageformats/qwbmp.dll

    • Size

      26KB

    • MD5

      8e1eb9386572d0c7e62e0230a67ff987

    • SHA1

      0c26b03c95cacf4ee63aaff2e52e6d732b0aadbe

    • SHA256

      e7bdd9c34a62b3b46d8e7d224be3f5f7607a27634a8a6fd4f85549869f2d1145

    • SHA512

      370b990e8cb3652c87190dabbff8440a1fb58282d860ed25b9fb2aac7c1809df176c8d6a4f685ac843fddf52f08cc07c832382eb6ae55ef5c4f3da74adf7a9f9

    • SSDEEP

      384:Ntm9jnAo9hvpbVDTs16ZHGg3FEE2IWgTrODw9:ejnAoHQzEWOOD

    Score
    1/10
    behavioral29behavioral30

    • Target

      MultiMC/jars/JavaCheck.jar

    • Size

      1KB

    • MD5

      a152019550e8fdc09c8a4a574aea4115

    • SHA1

      51d16ad3bd1d0f1405af337f40e0b5958253af76

    • SHA256

      bba65d67a00794af5e914091871d82536542af45158f194583d1dc8379c48174

    • SHA512

      6d0f9590e210c7b9be933eb1672612687e9d24e203622597dff7cf9ea92a53c438ff21d943e1c1c15be6ae31fd3aa98c535f8e14da00e7f62a0db0b277f43d52

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

Score
1/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

adwarepersistencestealer
Score
8/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10