Overview

overview

8

Static

static

1

plutonium.exe

windows7-x64

8

plutonium.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    plutonium.exe

  • Size

    4.5MB

  • Sample

    230320-y8c1tshc21

  • MD5

    1099bac1c472456ee3bf037ce6813dc6

  • SHA1

    12416f16ccfb09ba7a1750881f7edb97be79351d

  • SHA256

    ef4d81b7aadb22182dd5e359fb0ca4b389ddc794a27e8638eb89d037014dac93

  • SHA512

    dcbd271b66c16efc82876938e94f6694f1269e311d6d2c8f8024af683457f74c1f30d674f2df9c6662fdf54b477615dd722604bd94603c15273a1da6962f5826

  • SSDEEP

    98304:TUaMwIBAo2rY+MTMl3iggf2Gb76ySfqjUivCEkUNzjCeip/FYAhvj:oa+Ao2rnSMd/gvmLqjUdEkpeRuj

Score
8/10
persistence

Malware Config

Targets

    • Target

      plutonium.exe

    • Size

      4.5MB

    • MD5

      1099bac1c472456ee3bf037ce6813dc6

    • SHA1

      12416f16ccfb09ba7a1750881f7edb97be79351d

    • SHA256

      ef4d81b7aadb22182dd5e359fb0ca4b389ddc794a27e8638eb89d037014dac93

    • SHA512

      dcbd271b66c16efc82876938e94f6694f1269e311d6d2c8f8024af683457f74c1f30d674f2df9c6662fdf54b477615dd722604bd94603c15273a1da6962f5826

    • SSDEEP

      98304:TUaMwIBAo2rY+MTMl3iggf2Gb76ySfqjUivCEkUNzjCeip/FYAhvj:oa+Ao2rnSMd/gvmLqjUdEkpeRuj

    Score
    8/10
    persistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks