Overview

overview

6

Static

static

1

osu!.exe

windows11-21h2-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    osu!.exe

  • Size

    4.3MB

  • Sample

    240423-wj9x6aad7w

  • MD5

    3c14c93d40877ae816cc8ed03d38bdaa

  • SHA1

    418b808bbe42066f4d25fdd37593426b014a0b9a

  • SHA256

    8d73e298cbfd2ab3a3748c3512b6ad6ce4784aeaedc3f050b5bc48d51bddd651

  • SHA512

    40cc3b757a24312793457a582411a721a7997a32a1b75cdf548d74dfb9a72985e3b6b8c7bebefaf8e12f4dd25b1827c4f28d1330fac86bc74ae570ea4c7de3ff

  • SSDEEP

    98304:1ptvf9do8hOds0zJHpc4A2SBWuCZxRxpDOh:1vHo8IS0zppcqSMPi

Score
6/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      osu!.exe

    • Size

      4.3MB

    • MD5

      3c14c93d40877ae816cc8ed03d38bdaa

    • SHA1

      418b808bbe42066f4d25fdd37593426b014a0b9a

    • SHA256

      8d73e298cbfd2ab3a3748c3512b6ad6ce4784aeaedc3f050b5bc48d51bddd651

    • SHA512

      40cc3b757a24312793457a582411a721a7997a32a1b75cdf548d74dfb9a72985e3b6b8c7bebefaf8e12f4dd25b1827c4f28d1330fac86bc74ae570ea4c7de3ff

    • SSDEEP

      98304:1ptvf9do8hOds0zJHpc4A2SBWuCZxRxpDOh:1vHo8IS0zppcqSMPi

    Score
    6/10
    adwarediscoveryevasionpersistencestealertrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Drops desktop.ini file(s)

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Defense Evasion

Modify Registry

7
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

5
T1082

Query Registry

4
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks