General

  • Target

    Elux.exe

  • Size

    20.7MB

  • Sample

    230502-22ywhach73

  • MD5

    d239f3e981d0798ccd18ef24b63cc415

  • SHA1

    9e33a096ea0d60c37aecb3e66ecea05a9a0e0d97

  • SHA256

    760026182d118bc068abb9d46a8ea270216b4104ece674be1e86cc3e81f656a1

  • SHA512

    cef34f42b09bb373bc0d579d64e34a4202962e88a97d62b4481a76da3e51a2e416e148f3a78c7c1033bfc6bd0e7919e3d7f1805de73968ee5e77c1b56b569433

  • SSDEEP

    393216:Nu7L/TFxhQfu3xgQaaUX47d4arx+Gsx8fzdCZdiaE2:NCLbdQm3qQaaUI7d4arxFsxOBaE

Malware Config

Targets

    • Target

      Elux.exe

    • Size

      20.7MB

    • MD5

      d239f3e981d0798ccd18ef24b63cc415

    • SHA1

      9e33a096ea0d60c37aecb3e66ecea05a9a0e0d97

    • SHA256

      760026182d118bc068abb9d46a8ea270216b4104ece674be1e86cc3e81f656a1

    • SHA512

      cef34f42b09bb373bc0d579d64e34a4202962e88a97d62b4481a76da3e51a2e416e148f3a78c7c1033bfc6bd0e7919e3d7f1805de73968ee5e77c1b56b569433

    • SSDEEP

      393216:Nu7L/TFxhQfu3xgQaaUX47d4arx+Gsx8fzdCZdiaE2:NCLbdQm3qQaaUI7d4arxFsxOBaE

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks