736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
97a77c8e8daa0ad6717a99f95acfb160.bin
Size 449KB
Sample240214-clyhcsfe95
SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
MD5 97a77c8e8daa0ad6717a99f95acfb160
SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery evasion stealer trojan

Malware Config

Targets

- Target
  97a77c8e8daa0ad6717a99f95acfb160.bin
- Size 449KB
- SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
- MD5 97a77c8e8daa0ad6717a99f95acfb160
- SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
- SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
- SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery stealer
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/newadvsplash.dll
- Size 8KB
- SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
- MD5 7ee14dff57fb6e6c644b318d16768f4c
- SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
- SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
- SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
- MD5 8f4ac52cb2f7143f29f114add12452ad
- SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
- SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
- SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $TEMP/~nsis/c3a007/mineeonad.dll
- Size 577KB
- SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
- MD5 ec10d3888f7907ee3dffc5f883d84196
- SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
- SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
- SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $WINDIR/System32/midiasvc.exe
- Size 85KB
- SHA256 7e864083928b1574a3cdad0827653fb91eaf96acb0b32445ed4725c8ee3d7059
- MD5 e47777c0038db4950a72da594518b328
- SHA1 7f858c3161d020d0c500fbb29a0f2d38cb93d44c
- SHA512 4d6d02415afff4a2ceb229e3181dcd3fc7df89a99a3b6c7c0addb9f5265c03c1b3f0231f3b6d1c29c7e529ddfee83ab8e6f6a3e3e7eef838de5c42fbed60988a
- SSDEEP 1536:TkriKIIIgLMYHoAtSXG4FkgrExEJHmLtzZnLr4:TkWKBIAHoOaFkjEJGLthLc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  mineeo.dl_
- Size 121KB
- SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
- MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
- SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
- SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
- SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral13 behavioral14
- Target
  mineeo.dll
- Size 121KB
- SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
- MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
- SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
- SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
- SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral15 behavioral16
- Target
  mineeonad.dl_
- Size 577KB
- SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
- MD5 ec10d3888f7907ee3dffc5f883d84196
- SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
- SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
- SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  mineeonad.dll
- Size 577KB
- SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
- MD5 ec10d3888f7907ee3dffc5f883d84196
- SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
- SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
- SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  mineeosvc.ex_
- Size 105KB
- SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
- MD5 2b69deccb1730858b225c58f6437d64a
- SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
- SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
- SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  mineeosvc.exe
- Size 105KB
- SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
- MD5 2b69deccb1730858b225c58f6437d64a
- SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
- SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
- SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  minerun.ex_
- Size 129KB
- SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
- MD5 596199aebea31fbddb0044fdfb2e75ec
- SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
- SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
- SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral25 behavioral26
- Target
  minerun.exe
- Size 129KB
- SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
- MD5 596199aebea31fbddb0044fdfb2e75ec
- SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
- SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
- SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral27 behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverystealer

behavioral2

adwarediscoverystealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28