General

  • Target

    Essential Mod Installer.exe

  • Size

    9.4MB

  • Sample

    230524-y2c29afb61

  • MD5

    f33d3c19b7fd94d6b30d0597d9319397

  • SHA1

    b47dae72ee69195f3fca2a7b08ae0022076a605d

  • SHA256

    73fe0a497113ad970b1c09a1164b3dfa63b0a543b1c48f08afd7649fbde2e194

  • SHA512

    91e86721a2b228748e651d5ee6e4de802eac0d1c8d735ccaa7d40c26d0041b2b370d45c0bd17fbdebae7c991b2a94ad7cbb8c125b734f378b412c5749e47c2f0

  • SSDEEP

    98304:g2Nmnyq9lYcutuq8ol2suKkpWVb5TmT+219vWNC:nmnzYasj5TW9

Malware Config

Targets

    • Target

      Essential Mod Installer.exe

    • Size

      9.4MB

    • MD5

      f33d3c19b7fd94d6b30d0597d9319397

    • SHA1

      b47dae72ee69195f3fca2a7b08ae0022076a605d

    • SHA256

      73fe0a497113ad970b1c09a1164b3dfa63b0a543b1c48f08afd7649fbde2e194

    • SHA512

      91e86721a2b228748e651d5ee6e4de802eac0d1c8d735ccaa7d40c26d0041b2b370d45c0bd17fbdebae7c991b2a94ad7cbb8c125b734f378b412c5749e47c2f0

    • SSDEEP

      98304:g2Nmnyq9lYcutuq8ol2suKkpWVb5TmT+219vWNC:nmnzYasj5TW9

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks