4c41f2783d06008860fab234871376902930f6e07b85ab0c0a0f0c47e555534c

Sharing

Copy URL

Twitter E-mail

General

Target

59acfdfef603a6a182e837a1e742f1c4
Size

2.0MB
Sample

240113-3c9r5sghb7
MD5

59acfdfef603a6a182e837a1e742f1c4
SHA1

a16f8c195afaa84ed252d933141ad45a341f7cf1
SHA256

4c41f2783d06008860fab234871376902930f6e07b85ab0c0a0f0c47e555534c
SHA512

e86b353d7006d88e0b6e99bcaea7dba21b3f23503fe777e7d5fb6a8bf65adcb2f2645b86769ae956a3c51f02be53d93db1054ba8543f95e89762e48016993887
SSDEEP

24576:0HBtt7kdKOt47dwAV9apywMGunNtOcGW17Qcd7jizMSj3b8kAJXoC/1Zi3kIMeZ6:8GK57JLapylGuNUlcj6M1Xn3wJ0QNS1l

Score

7^/10

upx

Malware Config

Targets

- Target
  
  59acfdfef603a6a182e837a1e742f1c4
- Size
  
  2.0MB
- MD5
  
  59acfdfef603a6a182e837a1e742f1c4
- SHA1
  
  a16f8c195afaa84ed252d933141ad45a341f7cf1
- SHA256
  
  4c41f2783d06008860fab234871376902930f6e07b85ab0c0a0f0c47e555534c
- SHA512
  
  e86b353d7006d88e0b6e99bcaea7dba21b3f23503fe777e7d5fb6a8bf65adcb2f2645b86769ae956a3c51f02be53d93db1054ba8543f95e89762e48016993887
- SSDEEP
  
  24576:0HBtt7kdKOt47dwAV9apywMGunNtOcGW17Qcd7jizMSj3b8kAJXoC/1Zi3kIMeZ6:8GK57JLapylGuNUlcj6M1Xn3wJ0QNS1l
Score

7^/10

upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BrandingURL.dll
- Size
  
  4KB
- MD5
  
  71c46b663baa92ad941388d082af97e7
- SHA1
  
  5a9fcce065366a526d75cc5ded9aade7cadd6421
- SHA256
  
  bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
- SHA512
  
  5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/SkinH.dll
- Size
  
  89KB
- MD5
  
  205e3693cb24b95018eaee62af86ae03
- SHA1
  
  038749709bb472031c000557e57857222619dcd5
- SHA256
  
  4954323e4532552e5b3691986d579fdce8ebe60b6ec1eb049658103e05c9d52d
- SHA512
  
  4115d76eb964e8c84810ca1cb7758c74ef80d99168f38fb9ce036cea58f69b6579eabc16527b529a7f390f220d71952cbbcda84d20a05ef881714cf2c9a645cf
- SSDEEP
  
  1536:i0FjTj6ETvveOsaXY9oq6e8+NUUramdPlVoCi2l3PgCfHmYWmqh0NAGNYyq98M0/:i26aHJsa/qRU4h3PHfYmqOYz2ETOFdCY
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  4e96f412a8cc653053d5d918df6b0836
- SHA1
  
  a3c7d59043feecb1603874b27c23d4166b341f2d
- SHA256
  
  e4a54bfc327986a89165bdef361069810aaa985c3abecd442c786725fabaf977
- SHA512
  
  2fec61b4ad31250bdbdbbfd551d831801790b96902c67200661e8f4f2753378bbf6c0c88b12e1be9173a29597827c1c4809511b6d52666dc3324bd7031c8229d
- SSDEEP
  
  96:IiqA7bDe2xHkR1C41EhvSE+6nNtMn0iGd8CqRLqtJ1trRhElfL:IiqA7/ZH0uQMtcfCqo/tdgf
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/waterctrl.dll
- Size
  
  16KB
- MD5
  
  aefd35a23680fda066a05e4b5f6dc88e
- SHA1
  
  8278021d560722701c1f3b91b85ed96bf34bed0c
- SHA256
  
  bbc65291a3bcfb6559c391e251bca12d6b935a8a8de0825443642aa2b5e39e78
- SHA512
  
  7ac32589e0bf8889e36184058e1f2ae0a0b6c701188ed18fbaf5b45afcff06eecb760d29e342953d50091fb14ef2ee8fb3285a1ec2c1dadec3ecea18fcfe56a2
- SSDEEP
  
  192:BwgCxGHBykilusRf/D4WMJSuDVECsID01LkZVAHo4ZVZ9hOX/XDM9IHt:ijkHBeXErZhECsIDCyaH7f9h2/4s
Score

1^/10
behavioral15 behavioral16
- Target
  
  CR173Soft.exe
- Size
  
  2.8MB
- MD5
  
  a12342c04ae7081ef5608d9e18f9cd54
- SHA1
  
  e44a7d89cb4e286e593964cd62cb377040fcb2b7
- SHA256
  
  4ad778cfb89c20a9ea623e5c240add9fd7787ab9008ee7c58e5d121866020788
- SHA512
  
  2da4e2c4496933118322f47a579d0f9b799b09f1c9354ff2f98f5daa4daab8e757628925c4cf51118c46d6cf26a3406080e661ad08b6559427295e15042dcd17
- SSDEEP
  
  49152:S5jUNSJOLl/Uj+CR5GEDgzly/vlNWfPl2wmkfA:S52/5C6flyLWf0Lk4
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  
  Uninstall.exe
- Size
  
  163KB
- MD5
  
  558e768c6841fc5b375c454876a60199
- SHA1
  
  ef8a8e16ae8719bd1c63f498f0954496217e3046
- SHA256
  
  5c16680536014a3220767b2eece1a5c1f946dc8cfdda64b5db150ad760d42f8a
- SHA512
  
  60e538909b527682bc086a81f3d2ad2fab8f36941deff08720fb312c25f2dbc83100284dd4b3dc18ec7be2fe89a6ec3d3c83409bd68f4eef9e4fb8a63b907863
- SSDEEP
  
  3072:u4eYZ4+1JXJJc+zpi25shi25XSaINIH2cdbAi/0JArXNaeoLY1sSVTwH:b5O8Y+1JmhJYaIGMe0eXNykSGTA
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  ab73c0c2a23f913eabdc4cb24b75cbad
- SHA1
  
  6569d2863d54c88dcf57c843fc310f6d9571a41e
- SHA256
  
  3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
- SHA512
  
  99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
- SSDEEP
  
  96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
Score

3^/10
behavioral25 behavioral26
- Target
  
  Update.exe
- Size
  
  1.0MB
- MD5
  
  1d34986e0bb4f4e933eba46f912fc42d
- SHA1
  
  46bd731fb5b3b9a3166ea73c8c18ef62ffd17e48
- SHA256
  
  f8df18a17f76f9e233e5bab82b1c18798aa8bed64b011e55abba9bffcc27a0a6
- SHA512
  
  5e6ee40264ea63929ff3208fe33e138c76fba708293d42e083f442b632cf104c8029d2907cb76b325067744a4e23eb2fa6b54028bbd5dcdbea72e05b1727a145
- SSDEEP
  
  24576:3dptGf2C26K5ZGyljf+BhS210XCM66+TGiik7DQ4cOU8d:40+jS0M1Zil7ZcOU8d
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

UPX packed file

Checks computer location settings

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28