General
- Target loader-5.2.exe
- Size 5.4MB
- Sample240504-c1244abb2t
- SHA256 05a2bdd82c411c519faec6c30a4aed16cbdea5d1701b4bbb6f765195d5bc872b
Score
8/10
Malware Config
Targets
-
- Target loader-5.2.exe
- Size 5.4MB
- SHA256 05a2bdd82c411c519faec6c30a4aed16cbdea5d1701b4bbb6f765195d5bc872b
Score8/10Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Downloads MZ/PE file
Modifies Installed Components in the registry
Sets file execution options in registry
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Legitimate hosting services abused for malware hosting/C2
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Defense Evasion
Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1