Overview

overview

10

Static

static

10

malware-sa...04.exe

windows7-x64

10

malware-sa...04.exe

windows10-2004-x64

10

malware-sa...nt.doc

windows7-x64

4

malware-sa...nt.doc

windows10-2004-x64

1

malware-sa...oc.xls

windows7-x64

10

malware-sa...oc.xls

windows10-2004-x64

10

malware-sa...l.docm

windows7-x64

10

malware-sa...l.docm

windows10-2004-x64

10

malware-sa...nt.exe

windows7-x64

3

malware-sa...nt.exe

windows10-2004-x64

3

malware-sa...on.exe

windows7-x64

1

malware-sa...on.exe

windows10-2004-x64

3

malware-sa...el.exe

windows7-x64

1

malware-sa...el.exe

windows10-2004-x64

1

malware-sa...ab.exe

windows7-x64

1

malware-sa...ab.exe

windows10-2004-x64

1

malware-sa...nt.exe

windows7-x64

1

malware-sa...nt.exe

windows10-2004-x64

1

malware-sa...nt.exe

windows7-x64

1

malware-sa...nt.exe

windows10-2004-x64

1

malware-sa...FI.exe

windows7-x64

8

malware-sa...FI.exe

windows10-2004-x64

8

malware-sa...nt.exe

windows7-x64

7

malware-sa...nt.exe

windows10-2004-x64

7

malware-sa...LL.dll

windows7-x64

1

malware-sa...LL.dll

windows10-2004-x64

1

malware-sa...ar.bin

macos-10.15-amd64

1

malware-sa...an.exe

windows7-x64

1

malware-sa...an.exe

windows10-2004-x64

1

malware-sa...64.dll

windows7-x64

8

malware-sa...64.dll

windows10-2004-x64

8

malware-sa...28.exe

windows7-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8
  • Size 137.8MB
  • Sample240313-cpnsbsbh37
  • SHA256 b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
diamondfoxnanocorexmrigmacosmacromacro_on_actionminerpersistencepyinstallerupxvmprotect

Malware Config

Targets

    • Target
      malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.bin
    • Size 108KB
    • SHA256 1de6d9db409bef73e3585fc08f98b30e2757ec87830e6f84ba85c39210aa962b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
    • Size 333KB
    • SHA256 c4be15f9ccfecf7a463f3b1d4a17e7b4f95de939e057662c3f97b52f7fa3c52f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral3behavioral4
    • Target
      malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
    • Size 1.1MB
    • SHA256 5bac7a020f173d6c35f73d76cd3745a36564dbb3dd32f2d5fc5021c353e76a54
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6
    • Target
      malware-sample-library-master/APT28 FancyBear/APT28Hospital.doc
    • Size 76KB
    • SHA256 a4a455db9f297e2b9fe99d63c9d31e827efb2cda65be445625fa64f4fce7f797
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Registers new Windows logon scripts automatically executed at logon.

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral7behavioral8
    • Target
      malware-sample-library-master/APT28 FancyBear/APT28Implant.bin
    • Size 175KB
    • SHA256 489a1b13b5ec415f24bc4f1b4ed6c6e0bdc50ae95513645a839655bc75d4d9d6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10behavioral9
    • Target
      malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe
    • Size 192KB
    • SHA256 6f2589be92c2d0fa6050e52fbedb967c2590a8abbc4a9459fb7f78bc52407195
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral11behavioral12
    • Target
      malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe
    • Size 1.8MB
    • SHA256 4845761c9bed0563d0aa83613311191e075a9b58861e80392914d61a21bad976
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.bin
    • Size 776KB
    • SHA256 19be1aedc36a6f7d1fcbd9c689757d3d09b7dad7136b4f419a45e6187f54f772
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.bin
    • Size 785KB
    • SHA256 963c3bf38e90c2971e6875490e9d2393b9567f5cc3ee5e4c098b988bd2b852c5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      malware-sample-library-master/APT28 FancyBear/FancyImplant.bin
    • Size 682KB
    • SHA256 044f8ab501090fd77ae6e9ebf57e7fba9041be7ab986ce58f38583f4839a5126
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe
    • Size 334KB
    • SHA256 81e96c07e6c9cb02f72c0943a42ff9f8f09a09c508f8bbaa1142a9ee4f1326cf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10

    • Drops file in Drivers directory

    behavioral21behavioral22
    • Target
      malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe
    • Size 17KB
    • SHA256 dcbfd12321fa7c4fa9a72486ced578fdc00dcee79e6d95aa481791f044a55af3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Loads dropped DLL

    behavioral23behavioral24
    • Target
      malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.exe
    • Size 17KB
    • SHA256 3f48dbbf86f29e01809550f4272a894ff4b09bd48b0637bd6745db84d2cec2b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      malware-sample-library-master/APT28 FancyBear/MacOSKomplexFancyBear.bin
    • Size 131KB
    • SHA256 96a19a90caa41406b632a2046f3a39b5579fbf730aca2357f84bf23f2cbc1fd3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.bin
    • Size 325KB
    • SHA256 b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28behavioral29
    • Target
      malware-sample-library-master/APT28 FancyBear/Xagent64.bin
    • Size 276KB
    • SHA256 fd39d2837b30e7233bc54598ff51bdc2f8c418fa5b94dea2cadb24cf40f395e5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10

    • Blocklisted process makes network request

    behavioral30behavioral31
    • Target
      malware-sample-library-master/APT28 FancyBear/ZekaAPT28.bin
    • Size 853KB
    • SHA256 0320298eea0206b71d12f3a69730bbbec9768c5c323dfe131047f7ba4f4a8868
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

macromacro_on_actionupxminervmprotectpyinstallerxmrigdiamondfoxnanocore
Score
10/10

behavioral1

persistence
Score
10/10

behavioral2

persistence
Score
10/10

behavioral3

Score
4/10

behavioral4

Score
1/10

behavioral5

Score
10/10

behavioral6

Score
10/10

behavioral7

persistence
Score
10/10

behavioral8

persistence
Score
10/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
8/10

behavioral22

Score
8/10

behavioral23

Score
7/10

behavioral24

Score
7/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
8/10

behavioral31

Score
8/10

behavioral32

upx
Score
7/10