Overview

overview

7

Static

static

7

Danger/Danger.exe

windows7-x64

3

Danger/Danger.exe

windows10-2004-x64

3

Danger/Danger.exe.lnk

windows7-x64

3

Danger/Danger.exe.lnk

windows10-2004-x64

7

Danger/cmdbkg.exe

windows7-x64

1

Danger/cmdbkg.exe

windows10-2004-x64

1

cmdbkg.exe

windows7-x64

1

cmdbkg.exe

windows10-2004-x64

1

makeall.bat

windows7-x64

1

makeall.bat

windows10-2004-x64

1

Danger/makeall.bat

windows7-x64

1

Danger/makeall.bat

windows10-2004-x64

1

Danger/nmap.exe

windows7-x64

4

Danger/nmap.exe

windows10-2004-x64

4

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...71.exe

windows7-x64

4

$PLUGINSDI...71.exe

windows10-2004-x64

4

$PLUGINSDI...86.exe

windows7-x64

7

$PLUGINSDI...86.exe

windows10-2004-x64

7

Uninstall.exe

windows7-x64

4

Uninstall.exe

windows10-2004-x64

4

ncat.exe

windows7-x64

1

ncat.exe

windows10-2004-x64

1

ndiff.exe

windows7-x64

1

ndiff.exe

windows10-2004-x64

1

nmap.exe

windows7-x64

1

nmap.exe

windows10-2004-x64

1

nping.exe

windows7-x64

1

nping.exe

windows10-2004-x64

1

nse_main.js

windows7-x64

1

nse_main.js

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Danger.rar
  • Size 52.1MB
  • Sample240302-pwl9asde86
  • SHA256 ece8a18ca4213a95ef9b7d6f9bf18b81572c159cf2c7a836d70e2716cc7253da
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryupx

Malware Config

Targets

    • Target
      Danger/Danger.exe
    • Size 93KB
    • SHA256 237e4dba5a854dbc405369faa5290c2c5e238eebe9a78da1ab61e07332a44e22
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1behavioral2
    • Target
      Danger/Danger.exe.lnk
    • Size 754B
    • SHA256 0f910c6ab06b9a7b71bafd53fae092e83fb260f91e6b2046938aa8d3028b4d6b
    • MD5 SHA1 SHA512
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4
    • Target
      Danger/cmdbkg.exe
    • Size 24KB
    • SHA256 c616f22db40d43f720cf95fc99cfb2676fa9eccb7990e28cac96fedfed721b01
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      cmdbkg.exe
    • Size 24KB
    • SHA256 c616f22db40d43f720cf95fc99cfb2676fa9eccb7990e28cac96fedfed721b01
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      makeall.bat
    • Size 123B
    • SHA256 c02e18bcbc68984d751699ba9e740c591f6a70a6e5ff7d8ee5f5b1bf0a38b90f
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral10behavioral9
    • Target
      Danger/makeall.bat
    • Size 123B
    • SHA256 c02e18bcbc68984d751699ba9e740c591f6a70a6e5ff7d8ee5f5b1bf0a38b90f
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral11behavioral12
    • Target
      Danger/nmap.exe
    • Size 27.8MB
    • SHA256 f1160a33fb79c764cdc4c023fa700054ae2945ed91880e37348a17c010ca716f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 22KB
    • SHA256 dbb0173bb09d64ca716b3fd9efb0222ecc7c13c11978d29f2b61cf550bcd7aba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/npcap-1.71.exe
    • Size 1.1MB
    • SHA256 5ccb61296c48e3f8cd20db738784bd7bf0daf8fce630f89892678b6dda4e533c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral17behavioral18
    • Target
      $PLUGINSDIR/vc_redist.x86.exe
    • Size 13.1MB
    • SHA256 cf92a10c62ffab83b4a2168f5f9a05e5588023890b5c0cc7ba89ed71da527b0f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20
    • Target
      Uninstall.exe
    • Size 91KB
    • SHA256 1254968ea65be6a3e69c7918864e1562c89cecabe2c9a379b7508464e4446815
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral21behavioral22
    • Target
      ncat.exe
    • Size 319KB
    • SHA256 269e59fc701c7e0b02e2f16f983619ce49a1f579080189da7f659fa19fc44be3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      ndiff.exe
    • Size 30KB
    • SHA256 0ba1295afc0e5205541777ff5bd565e46ab40c5b9c4f425bbfceb800d306d8cd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      nmap.exe
    • Size 2.5MB
    • SHA256 780556634c875b1ecd721d3747194de3a52a674988379e73586ce7e167349c4a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      nping.exe
    • Size 341KB
    • SHA256 0c7b54a1056937bd4887dd5b7342a1b3165bbe89f6e3ac9b2746deaf704ba2fb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      nse_main.lua
    • Size 48KB
    • SHA256 98f3540719259de9f567d6b208632241df0e43dac79e40a789e87ab02168fdd9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

Score
3/10

behavioral2

Score
3/10

behavioral3

Score
3/10

behavioral4

Score
7/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
4/10

behavioral14

Score
4/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
4/10

behavioral18

Score
4/10

behavioral19

discovery
Score
7/10

behavioral20

discovery
Score
7/10

behavioral21

Score
4/10

behavioral22

Score
4/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10