66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677

Resubmissions

28-05-2024 10:29

240528-mjl2nafe8z 7

Sharing

Copy URL

Twitter E-mail

General

Target

DisneyClient 1.1.5.exe
Size

50.5MB
Sample

240528-mjl2nafe8z
MD5

d3c81e630fd6d136a291b43ee3e1b04e
SHA1

e4d155c36431232c227fd702c7143233b8847fd0
SHA256

66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677
SHA512

046f221cebd6fef5ff951d73de465d3cd656247aa1fabc40b67292fd7cd84dffc053e39dc6cbb70c53800eba464e0c8c37ffac44212d19892f58c24eec67393d
SSDEEP

1572864:R1JcJcidspJJrRZl9wjUwVpsSw6J9yVfGDGWhkU7:RPFicJNnlmHVSSw6MOCcn7

Score

7^/10

execution

Malware Config

Targets

- Target
  
  DisneyClient 1.1.5.exe
- Size
  
  50.5MB
- MD5
  
  d3c81e630fd6d136a291b43ee3e1b04e
- SHA1
  
  e4d155c36431232c227fd702c7143233b8847fd0
- SHA256
  
  66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677
- SHA512
  
  046f221cebd6fef5ff951d73de465d3cd656247aa1fabc40b67292fd7cd84dffc053e39dc6cbb70c53800eba464e0c8c37ffac44212d19892f58c24eec67393d
- SSDEEP
  
  1572864:R1JcJcidspJJrRZl9wjUwVpsSw6J9yVfGDGWhkU7:RPFicJNnlmHVSSw6MOCcn7
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  Adobe.exe
- Size
  
  5.5MB
- MD5
  
  6f4432d4272293b6e829ec8a7150bbe5
- SHA1
  
  21d94e2e936d20c70d77b65a7291d3d9ada2272f
- SHA256
  
  3a5f87afa90da2245e3714fecb56780dc5ac02deb101c2e4b8b83f0958c89cdc
- SHA512
  
  47408fe9fa33be6cfcd522915a71f6705a779e8301eb3c5eb78040fa5f28bb69a64e52744141f0a268a9ca14dd8b9e0bb34fd7aaa5ee9a19692daba48021ef9b
- SSDEEP
  
  98304:YkqnHtSs2J/G7QAKjHkxuDKh0qpS1W5zmzFVnAOaW6x8eHYWVk8GdsNoT:YkmSJ/G7QAKjpKyq04zmz6W6x8x7dsNK
Score

1^/10
behavioral7 behavioral8
- Target
  
  DisneyClient.exe
- Size
  
  112.3MB
- MD5
  
  dfcfc279ead34abb76dc24d0f5a0fbfc
- SHA1
  
  bde041a96ad64942543037136b84677b48381e93
- SHA256
  
  15266b3ee806793d382388e564d30814ad9a257d1f213840f286838cb6b3a92c
- SHA512
  
  1ac73fd15c228b31eb9231d117de148c45f4ae2c132a07ff57a3c58bff8a016f09076591a9941f81310f30e67898d85e1d3feb261d7e236293751fd0d9da56cf
- SSDEEP
  
  1572864:XfJBvQqy7wCHw+DqgWucHRifbOsTzVv3V8qekx34mefgprI2wACmucb2M9keuUo2:hBvQbrzMqekphUnCFOec69
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  5.1MB
- MD5
  
  6b84319ee8a0a0af690273d3d2dcbaf4
- SHA1
  
  857ca353e0582d100dcbc6cb6761bb4430d0cb90
- SHA256
  
  fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
- SHA512
  
  26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
- SSDEEP
  
  24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
Score

1^/10
behavioral11 behavioral12
- Target
  
  d3dcompiler_47.dll
- Size
  
  3.5MB
- MD5
  
  2f2e363c9a9baa0a9626db374cc4e8a4
- SHA1
  
  17f405e81e5fce4c5a02ca049f7bd48b31674c8f
- SHA256
  
  2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
- SHA512
  
  e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
- SSDEEP
  
  49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG
Score

3^/10
behavioral13
- Target
  
  ffmpeg.dll
- Size
  
  2.5MB
- MD5
  
  4d153867f33b8b517b7a3f8ab6ef6fa5
- SHA1
  
  9727614febffbefd66ad70d63a2ad43552d41135
- SHA256
  
  76b92fd8be8a585234c446e8bf696758181e3617200d3eca449e1ba3fa150d3a
- SHA512
  
  5b4c37479a7dabe6bd85f8050fe2dc36cd9492c419aa5e4225b015befc33bb47fd53ad7fcd91a494f52f55fad90baeef2fc4c7815abd5d50da881ffc8515a127
- SSDEEP
  
  49152:XLmyB/kMqMdqev+YEdOzvKi5rWniVA8IOg:7mI/kMqMdqe9zvKiOL8T
Score

1^/10
behavioral14 behavioral15
- Target
  
  libEGL.dll
- Size
  
  346KB
- MD5
  
  bd69da7f027cce989079107a03dcca2c
- SHA1
  
  49ada81426468b3e3607b5d36b7da116fe33fdca
- SHA256
  
  f31832152f5903bc2358a5eaadc1daa781169030f17cdb7348f19b4116640cb3
- SHA512
  
  30962cd45c58bfb9da1c432d0ec43eeb064a1f8b3381c93337170ec7817bd7f24fc3cdb1a3f88082c063eb49cf61998a92d3574f577516fca2697dd0898da3ab
- SSDEEP
  
  6144:WMsJQmSGv9SHEOCK6tNu2JztBwNWqERYRg2Z4uVPZIcwpJAc21DkbbTm:WmERK6tNVwNWqEnFuVPicAwV
Score

1^/10
behavioral16 behavioral17
- Target
  
  libGLESv2.dll
- Size
  
  6.6MB
- MD5
  
  d6dbbdde59fe87c6cf99d16380cfc022
- SHA1
  
  99e456a6b3e49a4e25c9ed37d35635b2393e9c1d
- SHA256
  
  ac468c2fa15a62557266a6df0caa331c1a814fc25ee760d88e6d6288da5e6e65
- SHA512
  
  bd9d12d38eed4dc6efa31e03a52ccf6cfd19394d179659e290c4ba3ea5a748d73f7a16e52437a4d7ea07a3856bcabfa2a5af73a5ad785ab8b00b427c9d293d48
- SSDEEP
  
  98304:GQCiOwIi7Xj2oGSfaxUsDXHc6Y+cE7BS25VowEPWyn9v9:GQCi337lfaWsDX86UAaVX
Score

3^/10
behavioral18 behavioral19
- Target
  
  resources/app.asar
- Size
  
  2.5MB
- MD5
  
  17400c88b0ff7c08991f9dfad7338c99
- SHA1
  
  2db5e5f723920097c1159cb22cfe3d48b35d9f7b
- SHA256
  
  110a8557545cb9d4f50b773ea72c083152a75112ecbaa7e7b8ca4948b253b233
- SHA512
  
  51d906ef30047d3c86ac1a0f30691cdd92a762df2ab4b313fbf2ca3c9572ec75d8bc040cbee82b7967f7e535080122f6bf9654de607d7c738bd27d09d860a821
- SSDEEP
  
  49152:nCXjRm4A4s4QNhAejRmf4LIyrWl20FhAgsJsZJsWwoJDbQkcXAfregLQNIyQw/tX:n0A4s4QE4jX
Score

3^/10

execution
behavioral20 behavioral21
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral22 behavioral23
- Target
  
  swiftshader/libEGL.dll
- Size
  
  366KB
- MD5
  
  b14e9a3b571cebb2db5eb64d5274b4e5
- SHA1
  
  3a30a13a61f2188c68ffeb83095279aca832eaff
- SHA256
  
  998ad01a7ad339373e499cc654a033be61b3796eab8880f34d453bbb774e318a
- SHA512
  
  5e1fa9c35ae896393840572f1bcaf26ff18a1d9aafc3504e8a6a1029a0f3e336e8ca06f07ad37371af690989fc4df174f721e9afe7ba7e00e13cbebbb520e808
- SSDEEP
  
  6144:M0xXgHVFDxkm2nh/nyce87Xi4dlwhNEkqZCC9uZaWPJqSpdZgO2J4+b2T:Lh/Ze87Xi4dCC1uZaeZxn
Score

1^/10
behavioral24 behavioral25
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  2.7MB
- MD5
  
  509c301d29ab71a65ee862530c0fdd65
- SHA1
  
  26a4c13749b6833635ba3280d319bdedc17f5fcc
- SHA256
  
  352448e802fb4947bdf8225844036de01200acbc4d85ae9b9d1eb95a769560af
- SHA512
  
  6150289efa7e2939d3f08d568ab2fa540e40fc640acb8919ae215b596905e88a0ee763f126c6de1e39fb5bfa676aa7d7f614020137288cced7d10c727011f4f3
- SSDEEP
  
  49152:4dnrjtIvoFzKkAdACGPIuV95gE+pZRNA32yJ6uhH2elKnmeEkAz4RnEoJ2rdzNBJ:4F3tfKNtja1MZdZ1X
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  3.9MB
- MD5
  
  be0b7e972b358b4c8e7574f2a611393a
- SHA1
  
  a9352dbb92f8079a5147f0c7f6cc1dd370bcfa95
- SHA256
  
  c5c5f9a38b4503e92d2eec6c89d7fee059661689cac05ccc197fd1d151a242c7
- SHA512
  
  9ff56e6d26f95823d0f684ea9842f601b606bc468734d461d23623177083decf34698e1dead43f965a419db7c322256c6e2b410c6c688eb361e61cd683c06326
- SSDEEP
  
  49152:9WzcL9x2ydlDTa7GmidqJfec1e6u9px5Uxb92ZpJyTlN9lp/5iY8E8oP7qG7rm7N:ZaK1GPm4gmZZrVSowgaB
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  616KB
- MD5
  
  d1ff51073fe428ac08765a13a3182938
- SHA1
  
  bd04df7dc54ee54faeb4a2eb7a64bc6a2d91f8c1
- SHA256
  
  2e9759f44620050351fa80d8192ffaf99bc39e2a1faefef335b8e70f437e9721
- SHA512
  
  664b4473029a6a51514930b6744add7c98c4f1b61f2a4bea1b294dd7b826326a24f743d246e73497b2b5c9fac43b0feaa82a11e241d3bf1a8202add1937132e7
- SSDEEP
  
  12288:IqVxi0ZmVhGfA8gFlkPdcarfoxpQGyHua8pyE/XPVPYo:1xJRrfQry4yE
Score

3^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32