eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610

Sharing

Copy URL Twitter E-mail

General

Target
EasyMC_Setup_v1.6.14_x64.exe
Size 61.3MB
Sample240609-hapc7sfg22
SHA256 eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610
MD5 3d34ef77549c696aa25ad60924afb265
SHA1 6989a37c8691475c60293251ef6ed743ac54637b
SHA512 91e115ff7023982e0c00436fbffd2f84a5ccb86244f67bf92758e1577ddc006b7e7d0a1cd33e434f19158f6fc696d40cceb050a9cd2bf39188ad226727ee99a5
SSDEEP 1572864:eV1g0aTp2uRPflkYr+p5N/2QWSuUPTZYfD2:eV1haTp20CYI/HWfUbZSC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Targets

- Target
  EasyMC_Setup_v1.6.14_x64.exe
- Size 61.3MB
- SHA256 eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610
- MD5 3d34ef77549c696aa25ad60924afb265
- SHA1 6989a37c8691475c60293251ef6ed743ac54637b
- SHA512 91e115ff7023982e0c00436fbffd2f84a5ccb86244f67bf92758e1577ddc006b7e7d0a1cd33e434f19158f6fc696d40cceb050a9cd2bf39188ad226727ee99a5
- SSDEEP 1572864:eV1g0aTp2uRPflkYr+p5N/2QWSuUPTZYfD2:eV1haTp20CYI/HWfUbZSC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral5
- Target
  7zip/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  7zip/mac/x64/7za
- Size 2.8MB
- SHA256 434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
- MD5 335361d7f6faf13cadbf116bfdb97226
- SHA1 d6cba0f2e221d1061261767ec38ddd7c550015a3
- SHA512 5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
- SSDEEP 49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  7zip/win/ia32/7za.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- MD5 dfd1cf824c781069def1d239a626d43e
- SHA1 bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA512 0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP 24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  7zip/win/x64/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- MD5 b7b7473472c9806bee3e7ae6c1adda23
- SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  EasyMC Launcher.exe
- Size 133.1MB
- SHA256 e65265cd415da534eb3984e50aec17f83596d6a37e7345f165e90fe788027b77
- MD5 e311796a24989bf6785699a2d3b482c2
- SHA1 e07b67cdcd393e558b94f9b8800361b69b4d1228
- SHA512 e52dc0f12da63f025f52fbfd32a2d52c596b50fca40535d8e783e844df60f5e01fbc0c770956bbe5825063453d090b80fd6af5197c1b74c375c77c272f698ff7
- SSDEEP 1572864:52HVo9Ck+yOBBdJAVwlymAETslfp409t:x9Ctx3tu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  LICENSES.chromium.html
- Size 5.2MB
- SHA256 bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
- MD5 4247afa6679602da138e41886bcf27da
- SHA1 3bb8c83dc9d5592119675e67595b294211ddbf6e
- SHA512 ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
- SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e
- MD5 7977f3720aa86e0ec2ad2de44ad42004
- SHA1 04a4ef5ccd72aa5d050cc606a7597a3b388c6400
- SHA512 8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d
- SSDEEP 49152:baOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:it59uEBm8geZz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  hostsremover/EasyMCHostsRemover.exe
- Size 13KB
- SHA256 136b6ddebbd837f775a10425fc0a6eaf4a46d32473f372208873cfeb2f64a28a
- MD5 dff1888306d5036e9e831d62d16412ab
- SHA1 2597f86a16af51f61f7b4754fe290a9969e85abe
- SHA512 c2f984340c6d01531151b6ff58d2e5b47740b3faf309bc28c6349c4dd2b1e8715e24a69ee238380bd3ffc52e7922cf6c9a0c1ab685f449dc7e13054383b1de62
- SSDEEP 192:wRT2kZJ9fs4yjyjLwxx/VUXfIF8KYc3qvUjaMmk/m:wRTd5fs4yGAx/V4fIFlYc3qsU0
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10
- Drops file in Drivers directory
behavioral14
- Target
  libEGL.dll
- Size 431KB
- SHA256 994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56
- MD5 7b77074945dfe5cf0b1c5a3748058d57
- SHA1 fdea507ac2be491b8ad24ddc1030ea9980c94c0d
- SHA512 d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd
- SSDEEP 6144:QpKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLVDc2/:QBl1EyyAZvJWM936wOJTWVDc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
- MD5 8c93e19281992a00993fc0f09e272917
- SHA1 3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
- SHA512 c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
- SSDEEP 49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  swiftshader/libEGL.dll
- Size 445KB
- SHA256 162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546
- MD5 be1b6fe26a1b5a3e1302c26ce5ce53f3
- SHA1 c3cac08e89c4cc91eae1cc87e33a1dea723f1d78
- SHA512 07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55
- SSDEEP 6144:NldwaUBIAHXboKn7YsGfJjjvQppfSH6RdW8wrpGLVgf8q:JWIsXboKnMAfSHChgUq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  swiftshader/libGLESv2.dll
- Size 3.0MB
- SHA256 c167a458174e2a280c39d7af31bd109e8e2921032a687097b584653adc33ab21
- MD5 1e401ccda5b723ab8a595a54f7d2531c
- SHA1 127716680dd16f776b19c2306d716935e54c5100
- SHA512 1f2f35021f338aa7c5a0ae83c196217fbca6b1d017ac1bb4f1eebb93bd6e18c5d74c1a14bd4899d7a91d054b0139b2c4fc3271c35148ad1d8b71139aff0132fc
- SSDEEP 49152:8NF/tcKnjh4NDNR32u7X5f2yRwT6mcavJ9BtCCp5kVtjjFCo5Z5UbNyJzSZ85C5c:8NIaqrNONEniz7P
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  vk_swiftshader.dll
- Size 4.3MB
- SHA256 a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5
- MD5 77f7b4f46cb3e06b53729fd1e562dfef
- SHA1 223c09805220ff2b5c1dcbdd5c0396231ea34f11
- SHA512 6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571
- SSDEEP 49152:ImuXbIxohwCWtm32rw3lYIDkhUw2B2w/XBnbtZNDNHI6iBewVqlnrSrMrXHYtvQi:Ca9dCeKOB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 715KB
- SHA256 22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c
- MD5 25afbdf6701013c57b19b92225920915
- SHA1 009300dd4ab3b81794388ce7d126ae90ff97535f
- SHA512 575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e
- SSDEEP 12288:oYa8yQ628GMAhXhpt1o9Sc4irKabLqYz/oD4C56:ZgQ6jHAhx71o9WirKaqYDa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral22
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23
- Target
  $R0/Uninstall EasyMC Launcher.exe
- Size 125KB
- SHA256 56274ae1ba0dba065ef15650ecba0cb722896ee19f5288c41715e1b6e0fa901d
- MD5 24729ea131a1e78311ca5c264d6633c4
- SHA1 43512fddd48bdc69efc80c21042dfa703de82afd
- SHA512 91b0d3f45b89c23103c6a9f84b456ef983c049ea1b7c53e75868585182f766efb847ea56125ddc54836bdf81f358defac4014197127f61b126037763976cfc95
- SSDEEP 3072:on77v00hEoDEtauxLXG7TQgp9aH2tvhOEA1RJCir86SrSrv6Ia3V:o740IBL2nPp9s2t0EyL+yaF
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral24

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24