Overview

overview

7

Static

static

3

ace35a7519...d4.exe

windows7-x64

7

ace35a7519...d4.exe

windows10-2004-x64

7

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ge.dll

windows7-x64

3

$PLUGINSDI...ge.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$TEMP/nsisos.dll

windows7-x64

1

$TEMP/nsisos.dll

windows10-2004-x64

1

AddScheduler.exe

windows7-x64

1

AddScheduler.exe

windows10-2004-x64

1

AddScheduler_.exe

windows7-x64

1

AddScheduler_.exe

windows10-2004-x64

1

DrBoan.exe

windows7-x64

3

DrBoan.exe

windows10-2004-x64

7

DrBoanMon.exe

windows7-x64

3

DrBoanMon.exe

windows10-2004-x64

3

DrBoancfg.exe

windows7-x64

3

DrBoancfg.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ace35a7519e1010bd00b7a8d610ec3d4

  • Size

    1.4MB

  • Sample

    240228-z8xwnseb8t

  • MD5

    ace35a7519e1010bd00b7a8d610ec3d4

  • SHA1

    02b4ec7ace1b2e867ee1934e41cde62c69a0db7e

  • SHA256

    cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294

  • SHA512

    f631396a9df6c9587a9a8170d8b98496ac0451bdb8f34affb821e3f99a00de15adcba757941d663170f47b9d8beaa5d95d20ed0a3ed0ec154a42001b13d9a472

  • SSDEEP

    24576:USQEUYDAfdDfBGGaA5YCOSKmRh9cJeSvXivZ+/KDONIY8cEpsbMh1:TQFIcbBGGaA5YCOSKscUS/Sk/KUIXcrG

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      ace35a7519e1010bd00b7a8d610ec3d4

    • Size

      1.4MB

    • MD5

      ace35a7519e1010bd00b7a8d610ec3d4

    • SHA1

      02b4ec7ace1b2e867ee1934e41cde62c69a0db7e

    • SHA256

      cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294

    • SHA512

      f631396a9df6c9587a9a8170d8b98496ac0451bdb8f34affb821e3f99a00de15adcba757941d663170f47b9d8beaa5d95d20ed0a3ed0ec154a42001b13d9a472

    • SSDEEP

      24576:USQEUYDAfdDfBGGaA5YCOSKmRh9cJeSvXivZ+/KDONIY8cEpsbMh1:TQFIcbBGGaA5YCOSKscUS/Sk/KUIXcrG

    Score
    7/10
    discoverypersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DLLWebCount.dll

    • Size

      28KB

    • MD5

      0bdd7c6f1046ea4b42839f991ae53fb2

    • SHA1

      cb9baefb10159b4a684fa1ee4372e7715865052d

    • SHA256

      0a0019b2603dbc4505453c2501255ab0cc0b3c317ece4a6ce0cfb6a02a30907b

    • SHA512

      96f41497f25d7bc81f51ab167f74243b4b767089c89c26f9752ef518fa60dedd2722c66ae87dad2334bcce1622bc12f7b9b892ae654ca58cecd9f35c9f1dc163

    • SSDEEP

      192:OQoR7CK9FX/dVPWtJ/tXP88bSNwWW8+YdbDT:OQcWeJ/XPWtJxPFYi8nb

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/ExLicenseDrBoanPage.dll

    • Size

      48KB

    • MD5

      9d017df67eb3202910016b66a7307df3

    • SHA1

      679041deaf30d05ff6fd5b84f40d53e17df02b99

    • SHA256

      9419910814e7fa9edb6248da63a0f72360604629de3e44cc48569ecb66450456

    • SHA512

      d7b3702d6b1effc1f00143f92a35b2c05825889138774b9b686264639bad72570c0300039d66cb8bc78e1ace121e5da18f8a31d7e1da1a16a52392ecd74cb30b

    • SSDEEP

      384:WTC+6JDX+jhWv0eUshsEPehLYCQ9xgZJwJyUP82ezEhKiXJIO4u:W5yXuhqS2/ehLYpDg7qZPD4

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      eef9e469e8a30717974499f277d97e2a

    • SHA1

      2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    • SHA256

      1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    • SHA512

      d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

    • SSDEEP

      192:8np6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTjK72dwF7dBEnbok:8p6UdHXcIiY535zBtMTj+BEnbo

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/SelfDelete.dll

    • Size

      24KB

    • MD5

      7bf1bd7661385621c7908e36958f582e

    • SHA1

      43242d7731c097e95fb96753c8262609ff929410

    • SHA256

      c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

    • SHA512

      8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

    • SSDEEP

      96:1dIrJYYrzPpqAAZ9sNIaI2y9WulXEGNRrG:nuYATpq/viyYuEYRr

    Score
    1/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c6f5b9596db45ce43f14b64e0fbcf552

    • SHA1

      665a2207a643726602dc3e845e39435868dddabc

    • SHA256

      4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

    • SHA512

      8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

    • SSDEEP

      192:qADKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQbVUSF:qAViJrtFRdbmXK8+WVUw

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      17KB

    • MD5

      6d8c0a8cfa17d5f514df99e0ea308eb7

    • SHA1

      4ed5be09ce30f700f9b31bd1b8ab088bdbcb5edd

    • SHA256

      715aee91a2d817c32c06ce12e20c6b499bdcc8d368f312fc58074a01f5dbbbe8

    • SHA512

      f2f444576fbdd1af1f3b782c895e98180791567d0939ebfee37bbc7d965e867f017f2436a8ca0aaaf67d65a307b90b1d49328f4677547af605344aecca242192

    • SSDEEP

      384:AnJJ9vt9UoWYNLt1XtoXgOM6UsyyFGL00Ac9khYLMkIX0+G+itGu:Anrm5YNLDxOM6UsfGL4

    Score
    3/10
    behavioral13behavioral14

    • Target

      $TEMP/nsisos.dll

    • Size

      5KB

    • MD5

      69806691d649ef1c8703fd9e29231d44

    • SHA1

      e2193fcf5b4863605eec2a5eb17bf84c7ac00166

    • SHA256

      ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

    • SHA512

      5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

    • SSDEEP

      48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn

    Score
    1/10
    behavioral15behavioral16

    • Target

      AddScheduler.exe

    • Size

      383KB

    • MD5

      2468aee85769d417642c530a9c7cc7d4

    • SHA1

      485f6e705ea1292006e6f1e7061e13fdd7cb6b05

    • SHA256

      469fba89c335c50a35224d4d0896f2a9d9774d524f58a142f6d883265ecf582e

    • SHA512

      07ae4f374be225fb850b179f0ed4c88d24c5c686adda653c2afedcc602413c8e9388787acda8fb44dd090203c6e06e7884454a4745d9e89cce15fc8303096c39

    • SSDEEP

      6144:G7GS1D7K18xPMQvF01cwaP0SCS8GMSQSlgTJ9Of+F/p/uwONct43D92UR:L8xPvv9P0SCS84l+TJ959pGHNu4B2UR

    Score
    1/10
    behavioral17behavioral18

    • Target

      AddScheduler_.exe

    • Size

      383KB

    • MD5

      d039b1ad2817d551bf0f9e0f5f5a6321

    • SHA1

      f83fb915221379efcc5c7137e841611c885d690e

    • SHA256

      bb525c7b4ac418d3307ff61597c5c64dc65a3eada37b3fcebe084242418a6be0

    • SHA512

      0caa7260a64e9d5ab9c4306e274e11d90f396382a665420e1409d83f815cb318eda04755255e138ab6db8854763915fc35787bc40d360b39ede7a2e3cd5d523b

    • SSDEEP

      6144:l7GS1D7K18xPMQvF01cwaP0SCS8GMSQSlgTJ9Of+F/p/uwONct43D92Uo:Y8xPvv9P0SCS84l+TJ959pGHNu4B2Uo

    Score
    1/10
    behavioral19behavioral20

    • Target

      DrBoan.exe

    • Size

      5.2MB

    • MD5

      5656aee6cd4d9a76af801468af57b82c

    • SHA1

      5048f5256f5bea433eb00d17762308504406104c

    • SHA256

      4d443cf4541e8ceb71504ee0e192cc42361e1e2a225bc4450d1b259a18d31d42

    • SHA512

      8e5153eeb6f930d2675d0ec13d18792497bad06a09a05fd9595fffc5741e89c6ef38e5bedaa0d151e072861c8d8fdb34e81b8da9a3943348e274ed55d10516c3

    • SSDEEP

      24576:fGAAL2tujT8eWZ/kkSKjMEdhusdNcbCskoA1J0O7Xeh0+K0XP1I:VI2tuEek/SK4oYIybCs9guUXeh0+K0dI

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral21behavioral22

    • Target

      DrBoanMon.exe

    • Size

      853KB

    • MD5

      c0a32177dd78688ebb7cdd6c38943bf1

    • SHA1

      bb6f909f6ef0122298e3fe37eb070e05e212ec66

    • SHA256

      5dac1272013def2d66a950ce2d253dc96acfe597b6b3bf36bab8547dcbc3addb

    • SHA512

      4827aa6b0a0dcaf005325b12ad6a8811f57802caf274bef32b7d4404bb610508a07b1aed917d07773b1845991c5671aafb813fe0b4e80830d8ac75a4476cae22

    • SSDEEP

      12288:mAyJopEqZPZhz7L6/4aqUBvyOQ0+kF5l2:m9J8ZxaxvvQ0+Sg

    Score
    3/10
    behavioral23behavioral24

    • Target

      DrBoancfg.exe

    • Size

      556KB

    • MD5

      8249122b4ee495fbf6c57e5acbe61f30

    • SHA1

      adc2240bf074742e8bf51ed81c710ff6e21148a7

    • SHA256

      e99b9b64766b41d903440ca9ddf081d83cc96d8766c82cb2836828a1d63bda45

    • SHA512

      3a331d1829fa32c4120be21aab3c4dc9a30bc86c6967c1dd7064b65b14d218ce6a3cbdfd4b1238fcca11d6ef88d69c6d53cb717eaf5a535487721c74d9333f73

    • SSDEEP

      6144:NMsS2dujTfHkwWpo0nQ071oY08IWdOARrGcsicw/rs3AMbkq6cuQF0lY5:NMsBhwWm0xIWIARrGcOvA8kq6HJG5

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral25behavioral26

MITRE ATT&CK Enterprise v15

Tasks