Overview

overview

8

Static

static

3

8ca8c891e9...e8.exe

windows7-x64

8

8ca8c891e9...e8.exe

windows10-2004-x64

8

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ca8c891e95359312e0a42f1f00fe42eefb662f66a61715ead3865d27fbe27e8.exe

  • Size

    541KB

  • Sample

    240523-b5nxlahb2z

  • MD5

    93616677d7d1ebbfb979b905150bb3cd

  • SHA1

    87037c76bc789909d49fa81887ce8465436f3ca0

  • SHA256

    8ca8c891e95359312e0a42f1f00fe42eefb662f66a61715ead3865d27fbe27e8

  • SHA512

    cc17b5c1266c01dd8bf1d2a5269e228a3389083eca13cc1352f6638ab72a95beecc4e3a7b29d892813eb1843b0bd8b207fa987ad6224dfab6b606167946b5595

  • SSDEEP

    12288:iH7MMIqb9BVAG8ITBF8qgvpnu1uo6c1yZODqCNtEplW8LmP:C7a69BVxh65K6+drGlW8LmP

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      8ca8c891e95359312e0a42f1f00fe42eefb662f66a61715ead3865d27fbe27e8.exe

    • Size

      541KB

    • MD5

      93616677d7d1ebbfb979b905150bb3cd

    • SHA1

      87037c76bc789909d49fa81887ce8465436f3ca0

    • SHA256

      8ca8c891e95359312e0a42f1f00fe42eefb662f66a61715ead3865d27fbe27e8

    • SHA512

      cc17b5c1266c01dd8bf1d2a5269e228a3389083eca13cc1352f6638ab72a95beecc4e3a7b29d892813eb1843b0bd8b207fa987ad6224dfab6b606167946b5595

    • SSDEEP

      12288:iH7MMIqb9BVAG8ITBF8qgvpnu1uo6c1yZODqCNtEplW8LmP:C7a69BVxh65K6+drGlW8LmP

    Score
    8/10
    executionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1c8b2b40c642e8b5a5b3ff102796fb37

    • SHA1

      3245f55afac50f775eb53fd6d14abb7fe523393d

    • SHA256

      8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

    • SHA512

      4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

    • SSDEEP

      96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      09c2e27c626d6f33018b8a34d3d98cb6

    • SHA1

      8d6bf50218c8f201f06ecf98ca73b74752a2e453

    • SHA256

      114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1

    • SHA512

      883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954

    • SSDEEP

      96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P

    Score
    3/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks