3f95350bec78f3895ea0c097358108f965eadfd3063d3754db8f864f3a5cbb6e

Sharing

Copy URL Twitter E-mail

General

Target
01ee6aa88ccfb589bde33b360ad45300_NEAS
Size 3.0MB
Sample240507-xdc7nsaa2t
SHA256 3f95350bec78f3895ea0c097358108f965eadfd3063d3754db8f864f3a5cbb6e
MD5 01ee6aa88ccfb589bde33b360ad45300
SHA1 a17e4ba8624559a88e8b586b2405fc2550333cb1
SHA512 15d5e0930bbab96e0b6434fcc0a4f52adbe772988169f292b136f240cd3a6ab9fac50244f703443be06cef75f0021043bfcee481a02ef93da2316679f0643e12
SSDEEP 98304:IkA6wBUw3OFfN6/4BccJJ8q6I8UImCMT+Ygwv3G53hkIs:XqfOFfU4Bc68Ui6+Yxv29s
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  01ee6aa88ccfb589bde33b360ad45300_NEAS
- Size 3.0MB
- SHA256 3f95350bec78f3895ea0c097358108f965eadfd3063d3754db8f864f3a5cbb6e
- MD5 01ee6aa88ccfb589bde33b360ad45300
- SHA1 a17e4ba8624559a88e8b586b2405fc2550333cb1
- SHA512 15d5e0930bbab96e0b6434fcc0a4f52adbe772988169f292b136f240cd3a6ab9fac50244f703443be06cef75f0021043bfcee481a02ef93da2316679f0643e12
- SSDEEP 98304:IkA6wBUw3OFfN6/4BccJJ8q6I8UImCMT+Ygwv3G53hkIs:XqfOFfU4Bc68Ui6+Yxv29s
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  DmMain.dll
- Size 1.1MB
- SHA256 a2fc2c6e48ad7c96ca4d0f309416e870e232e1745a564ac604fc2472c64cbe8e
- MD5 3d1f90d87b4cef211e3deee64a3cea61
- SHA1 cee8b951718889a566f56a4bac7e6c316cfc4828
- SHA512 a0ba182710e8ad27422290fd4e80533da197331b027e47a3b7210d0dd4b4f09f7285610555c199d0ba016c1efce12f6028784dd54e45376e679dc87040fd7177
- SSDEEP 12288:7AAljMBQDKY6BP5BMG4s3nP0xy8VntcmO+2T5yRT5dOfht1OBLtf9aJWX3JyIMXv:EnmKY6V5BWxLVtYpt2tVaQJy9Xv
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  ltzn.exe
- Size 1.1MB
- SHA256 bb4e34b1a8c69f0dda2ffb8ed7ec532bb63588749861a7dff64098a4655456a8
- MD5 a80dc7bbca76113f10b6dff20c3bc0e4
- SHA1 59b4fcb138dcfab9f89c9b1658c098789cce9e7e
- SHA512 b12b000184483f49bbd9463c12cc311299a32527e37e46e30fc11fe20dffc732302eddff15f6d9d1d1b814f182aa3f6cd9bedbcf8cc1093494e53885dcb154f9
- SSDEEP 24576:yUNeiVAaUK9Cp2jYNT9qgATstYKAbCmekA6wBUw3OEYo6/4Bq5:yUvAaPCp/59qgATE3A2mekA6wBUw3OE4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  uninst.exe
- Size 412KB
- SHA256 6f16f519d7ffb4328129845db52ee57ccee69933a45ca7b238b42e08e573ad86
- MD5 68ef438bbe0ab520fef59f1b873ce8b0
- SHA1 2e7bd1304307958e22e6c5db69bc02e6e8fa5720
- SHA512 540d3dc30563b054440ed0b6e93518be2b5bc6ca43ddf375f295dafc0a18c0417d7daf6fa102cab3407bbec940be3d3ae0701100c9c8ae0e7b4232930c391c86
- SSDEEP 6144:uNDlOYPDE3GgWbOcs69midmz8VEpSl67BdrHiSvcfJL7f7mDqAaHmrU7yGD0j4:u9oAb86908V4BdBvcfJPbGrUz0j4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20