b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73

Sharing

Copy URL Twitter E-mail

General

Target
b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
Size 7.1MB
Sample240612-e6wkls1cnp
SHA256 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
MD5 be9a87d9ac301266af08218734ff4224
SHA1 c46026f4015bed9ecf183be84c60c230b291a0db
SHA512 7c8a31d0c92ec948f4788160b4233316746ae32adb0341f80f050c2abce4a23b6987f4123b6da5d5d51afb182bce662d694f434dee711732d9c780a0504035d4
SSDEEP 196608:Qbf0n7QqLlUTuyTfcD4RmT5HdIFbyTu25SmF/5:QbG7Qq+h0YM9Mby/5Sm3
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
- Size 7.1MB
- SHA256 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
- MD5 be9a87d9ac301266af08218734ff4224
- SHA1 c46026f4015bed9ecf183be84c60c230b291a0db
- SHA512 7c8a31d0c92ec948f4788160b4233316746ae32adb0341f80f050c2abce4a23b6987f4123b6da5d5d51afb182bce662d694f434dee711732d9c780a0504035d4
- SSDEEP 196608:Qbf0n7QqLlUTuyTfcD4RmT5HdIFbyTu25SmF/5:QbG7Qq+h0YM9Mby/5Sm3
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LogEx.dll
- Size 44KB
- SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
- MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
- SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
- SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
- SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/inetc.dll
- Size 434KB
- SHA256 2fd047e73350f864d85b2bc128ec19cc30b7d47db656aad08aa7923155ab4f97
- MD5 210f551d877a262fa2b32fa23289ffda
- SHA1 a527a7b94711146843e1dd78b61b1ba78dce2a26
- SHA512 ba9486f02b602e0208cca4f1ca64d3f2f601cbd239ebc8b11e5b80d55dc7eab0d0bfcb20444e505a2e3b4fd3ac5a0c9cb5e1b3753e4aa302c70770453ea798a6
- SSDEEP 6144:Olat1rg5hb6fAEHWAxpEFrFQhi4oOkM4lpfO8BgKL8OxwFCLGZXj:o4g5hbg1WAxpEJFXFlF1gqxwFCL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  CrashReport.exe
- Size 1.1MB
- SHA256 3124871115df9aa1b5883810ef517f3c6b628314cc027f7d9242299677adde13
- MD5 9983f02133e3a9b7c374f49ebef1bb22
- SHA1 e58815eb8b034c1cd3d24efd8fabb96dc9fbb2b9
- SHA512 167db0c962d4bea4c98743844a94cba6826b6e79a895903736db33955fe7f4a5fa01fad292681c8298de97f39eed7c9bc4c2e89546f99921711843fbc565fbae
- SSDEEP 24576:VHtxJLzqmtRRYzFS5jyedubyjiIf9uNftb7AIAewvYj9tLd1abOVnt59RoKcZ86l:RHBWoRyzqjyedubyWIf9uNfV7AIAewvN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  InstallSystemTimeSyncService.bat
- Size 179B
- SHA256 55c6a33051fdcd000084593d093ad02863fe97068609f27e8de16901935baf52
- MD5 a7064c6865c7e3c53d34c6eaf693aa03
- SHA1 f000692f607e2cf6a88c8f68ea6d9313619d5356
- SHA512 837ce7186ce58ab18a25c45af571eba78048473745b309cbe54bac435a56dc77dc9d65f3f07645b8dde501a99c6157cd9caebbda27cfb3085f90e466c7fd9a90
- MD5 SHA1 SHA512
Score

8^/10

execution persistence
- Creates new service(s)
  persistence execution
behavioral15 behavioral16
- Target
  SystemClockHook.dll
- Size 221KB
- SHA256 6c8bcc59b466e3562f067c9818d41a3cfb3c3a16a0087f1c3b01d0dcccf7cbf2
- MD5 a7d86ed5997983ec1f994ac6db0f9528
- SHA1 698b6a99c3d6fab20213b70be2f865fcf04cbd1d
- SHA512 852f69b3c0c28c733e9c05e20ece0837a07ee96b07f042b84a8c6d410e55e8e83d49918c08ed237fa06440cd370bcd460dbcf8a2fe6141a709dc681469452e0b
- SSDEEP 3072:c0EoPvvwCwQC2mCGxVBuQa3v90q68JSrfgIwt30yq8LJ3UCMucUYmPhmdV/mYtdY:HEovwCWG3VZFSzgJUGK2rOPJ9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  SystemClockHookHost.exe
- Size 112KB
- SHA256 8abc0ec4f912026b300b2a564904577bf4048b435d4b43e26ecf22405d3efd4b
- MD5 5d445a73c7cfdd4f03c4ad93e6475c57
- SHA1 58cde8ed44a766451ee7c47858a3542d103f4284
- SHA512 9917fe7c15746860360f1db148a3cabea4349a0e66a30b4572b64e3cd4c60d39101be262f57586242cdad42d3f966702d9ab45fe2e7f7ee001c03050da8ce24a
- SSDEEP 3072:ECTmgqnd0isEuKVVeOeqsH6/oCJWnBYY7BByncxG:HTxq0isyZ2Bcf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  SystemClockHookHost_x64.exe
- Size 125KB
- SHA256 94ea02eed6c7cf4e349773e00be51d791c35399b341b1174b12815c50dcb5564
- MD5 22cb902359ab5b2e14d36c3e47320d44
- SHA1 4b62dbc7be7f33c10bf9bdcc4ca0c373dd5b4214
- SHA512 e6948e9f993724a508930309ca595f8c4066bcab3f4eef1ccc67da87d536bd2f5ebac13161d413efa47c0e60a3ed4476617010a35fdf4d3fc916fcd210c4adfd
- SSDEEP 3072:z9oM7hY27gAzivYQnsQtG7vQZKCUtWVY+9NnnbxwQ:ZFYrOivHnDGy0Y7NaQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral21 behavioral22
- Target
  SystemClockHook_x64.dll
- Size 257KB
- SHA256 51c326343e505706ec3c72ba8c9e1fb114b6b2726dd19ab1e41e2bce8c179d23
- MD5 2b74042ee8dbd812f9be1458b5eb83b5
- SHA1 c493e439b61cbb4f552291b078fa08e61bae43c9
- SHA512 6c9c0fd770c357a440a0f3b0c235ab02184ab3dc060482ed3fb2caf970560c4dd6361096021457cf4981a1d6c75d425754cddb434027a0fb057051fbe00caf61
- SSDEEP 6144:94leAGyEHTfGJdgvPVES0/4AFonQBG/82Pdn:jAbEHTuJaX4/4AFyQk/82Pdn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  SystemTimeSyncService.exe
- Size 337KB
- SHA256 ade4c7136d191729bf74d271358035b8ee80f533236e221c39b805400718f4d7
- MD5 77d3503b66525f8004abbeddd6edcdcf
- SHA1 5b77d1f87981b4e9cbabb89b5e354453895e60ae
- SHA512 56f571cd4747b80930279f6d6385aa2c6e0026c49b8264990e2be4dcd56ffee939c5e61870d87468ee36014003f915cf698ed374337f772dd4d5ba22ef360491
- SSDEEP 6144:DsVsVdyJQI0QOAKmTkayBnDpFgW50w92J4+D5rqGfnEAOAd6GN1FOh+V:DsugIQOZEdyBDpSWFOtvfEqdtXFOh+V
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  UninstallSystemTimeSyncService.bat
- Size 72B
- SHA256 ee7fa177b3262fd07801cb129b122cd42bc66e61f6b7f3b9b10a837c563d645a
- MD5 266baae5a3f6cf8a9838dce0aa04fa87
- SHA1 862c70a5d15778a8ec77dee6098ed169cb931cdc
- SHA512 676affd8f44d6c26be5315bbaf016e70dd6ee5df6722684015e6c8fa83a62edf8c47d73d3f119666c19377f1ba33d0449662ed9001a564bc26f9d721bf035dee
- MD5 SHA1 SHA512
Score

8^/10

evasion execution
- Stops running service(s)
  evasion execution
behavioral27 behavioral28
- Target
  YXCalendar.exe
- Size 8.7MB
- SHA256 7b59ce0108b3474df9c3282afee1cfc41e0e572d5cf7b2cb72c3cc64ce77bd7b
- MD5 18418c7f12becb03f65121f37f50c284
- SHA1 fbb2bd6f4494dc9e8798c0e2209de2967af69f80
- SHA512 d546d4df4055c163aa2592423b92b82275e2a144cd713d1be513e02893cf223b216da6ef9a473acaaff3a2f01ff4f75780b484ae25403b9cc5fc51f4895a12b1
- SSDEEP 196608:jIwzaWxdeNctICkmDcoPTDZ/tTpIhFeXawoE0D+JMvd:jIwHxd9tDcoHZ1wKS
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral29 behavioral30
- Target
  YXCapture.dll
- Size 607KB
- SHA256 96290694a953e721c87d1b30c02190598f93a77e9f58fe0c0e584d5214a3a27e
- MD5 5c67357fca4bbebb215b8dbf1d617300
- SHA1 4e56bef46f87ede792cb8015eff59eb430896627
- SHA512 e24bd58be87bca99f5e68096fef7a3ea067d26146142dd1e53279bbb60207783562f2d9732bb257e68b3f75a1ab46129def472e3c76f1500f92a5f0c56df98a2
- SSDEEP 12288:Bl6rwCkTDoxkYbAQpJUnFDQnCWK9tmyDHdmNs:Bl6r9AKI2nCTKit
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Creates new service(s)

Checks computer location settings

Adds Run key to start application

Stops running service(s)

Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32