Overview

overview

7

Static

static

3

bin/incogn...au.dll

windows10-2004-x64

1

main.exe

windows10-2004-x64

workspace/...est.js

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.zip

  • Size

    21.8MB

  • Sample

    240522-yv1vqsef5y

  • MD5

    99441db67445971ed197c07170f47f26

  • SHA1

    10c2296c06fbf68ce760ce2898eb3bec1f1975d1

  • SHA256

    cc24fb493ea2e8b879429b3d4a475d2f9abc4a3ccca61fdbfdbe3a71af16d722

  • SHA512

    60b7b40f48ead820a2fc94cc773a23c614e1e29acd70c5247ab127e7f62fe58408795ce295da4f84d286f853524728a8a75f0c99840208012660da8a9bba0e2a

  • SSDEEP

    393216:c2ajdxYGKTL3XGsQ8wmk3M5W07p1oZQBnXqf9bOKGpDcIjvlYbkFzRT:c1xYGKP3WsQ8wmk3iW0AUaf9iK64IOkf

Score
7/10
execution

Malware Config

Targets

    • Target

      bin/incognito-luau.dll

    • Size

      1.3MB

    • MD5

      157fd035b2a344a94166d7db3756df0e

    • SHA1

      f221d28c1deb80b4e8d9201226435aefce6b0f75

    • SHA256

      8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009

    • SHA512

      fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d

    • SSDEEP

      24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk

    Score
    1/10
    behavioral1

    • Target

      main.exe

    • Size

      20.8MB

    • MD5

      a18229feee8fd2a2d11caf3334962724

    • SHA1

      4c1a078607d9cb97103bfb3122be3b45bdeff817

    • SHA256

      b9c4ebecf944e0e9955f86a7581b3b02187ce64e78011035dedab40377ee3001

    • SHA512

      fc35eb60b4ab3014c680e4fdb2c54eea08ee7480c6c765402985be532d3465bd28317482b0e4f4cd2e69b4691a5a19974e2e8229b1001269fbd189d14b82c37a

    • SSDEEP

      393216:qdjJmE6NrDREnCE8odCMiqwmtD/BFZTFjRUpLHfKg4NMaTSzmGg37P:6JmE6hDOnCE84CMMmt7XepL/KQajGg37

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

    • Target

      workspace/luarmor_compatibility_test.lua

    • Size

      8KB

    • MD5

      1f256596bbcde8ed0506e008e9d02074

    • SHA1

      4d9ff37f8bcd5fbc3ea6929792565575baf69122

    • SHA256

      84d347276debd97eda22b5f408b0c50baf48d3be103ce941e74f3af5b6583907

    • SHA512

      8476d5430f161a0201bdbd1a64cff2f17412e614a558cf80beca5ed3deac394d3b53e9c48964bb64197e38e347d385f125bd1734ab74de0c27fc1e31d4073f02

    • SSDEEP

      96:O4cGBg1Xs6/v/qLVZtVp4qxwqOqxeaYqqxHqCq3RLNx8x97V0ojS8R/f87URbUer:OHGe9e77Ln1YDKDk97KojS8R/oLWKm

    Score
    3/10
    execution
    behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks