bf9955dbe651593868ab09a5914655ecf16502b81e54efdc859f273148f427bf

Sharing

Copy URL Twitter E-mail

General

Target
vmd194a53win64-SetupV7.exe
Size 44.0MB
Sample240614-rbm17stdkb
SHA256 bf9955dbe651593868ab09a5914655ecf16502b81e54efdc859f273148f427bf
MD5 c9c936133606ca2c4783d2a70272f6d1
SHA1 738996ed4a502613dfea67d3ccd8896dcbac9c30
SHA512 af955a0289271732d63a0f59f31bdc5f5376d35175388764eb2c1bd8eec88654e00af5a30f15700a9ab69aee989e36881bc00d8eeeb3af979be3c474f89be0e1
SSDEEP 786432:hnFG/QE0rOuM/layTHfg2QggRQT/S68UsoH8nMTAXXJQRvfuezU/kwf8CTti4ID1:RoQE0DMAyTH7T/MNoH8DpsRPwDT84a7R
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  vmd194a53win64-SetupV7.exe
- Size 44.0MB
- SHA256 bf9955dbe651593868ab09a5914655ecf16502b81e54efdc859f273148f427bf
- MD5 c9c936133606ca2c4783d2a70272f6d1
- SHA1 738996ed4a502613dfea67d3ccd8896dcbac9c30
- SHA512 af955a0289271732d63a0f59f31bdc5f5376d35175388764eb2c1bd8eec88654e00af5a30f15700a9ab69aee989e36881bc00d8eeeb3af979be3c474f89be0e1
- SSDEEP 786432:hnFG/QE0rOuM/layTHfg2QggRQT/S68UsoH8nMTAXXJQRvfuezU/kwf8CTti4ID1:RoQE0DMAyTH7T/MNoH8DpsRPwDT84a7R
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  scripts/tk8.6/msgbox.tcl
- Size 15KB
- SHA256 9a6281fb0a1927d7b81fce9ebfc95235bd88df114ad8a87afea8ea6b0953338a
- MD5 5340a2d8baab7587881a28a642c4bd99
- SHA1 46c1882f978a4d7a6ed0d2f220edcbd89dbbfb3f
- SHA512 71e766c6020ce66328ca2f78d8e3b0444bfcb4dfe0b364c9cc8c5734d9ded3aec04c7fe7394b9cd21f33999d65f927bc91e0ce6d829beffe8b1d603ebf42b836
- SSDEEP 384:aWsDPYblrrfcRcfjAwkTS3ifQjvwMXEcjY:aTRcfjAwkTfQjvPXt0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  scripts/tk8.6/palette.tcl
- Size 7KB
- SHA256 60b8579368bb3063f16d25f007385111e0ef8d97bb296b03656dc176e351e3ca
- MD5 abe618a0891cd6909b945a2098c77d75
- SHA1 a322ccfb33ff73e4a4730b5b21de4290f9d94622
- SHA512 2df5a50f3ca7d21f43651651879bcae1433ff44b0a7ece349ccf73becc4780160125b21f69348c97dcd60503fc79a6525db723962197e8550b42d0ae257fd8e7
- SSDEEP 192:ZUW5yUd51URCJWgWWWuWVWUKoDOdnAjLDlJymGH91QOW86vkQI:ZLXaCI3dFUlPdnAP69W89
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  scripts/tk8.6/safetk.tcl
- Size 7KB
- SHA256 9708f5a1e81e1c3feaf189020105be28d27aa8808ff9fb2dcca040500cf2642a
- MD5 efc567e407c48bf2be4e09cb18defc11
- SHA1 ededb6776963b7d629c6ace9440d24eb78dea878
- SHA512 bda5f92bd2f7b9cd29c5a732ec77a71291778a0ec3eabe81575c55de3e207f663ba28da4c95174045a74efff71b95d907c9d056baa9e585e6f6dc14a133760bc
- SSDEEP 192:keEoaa0QfsimXZrjpgj47e5QeO9uMfUKvLAN6Zo:keEoRHsiWddgkoiUeG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  scripts/tk8.6/spinbox.tcl
- Size 15KB
- SHA256 5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a
- MD5 9971530f110ac2fb7d7ec91789ea2364
- SHA1 ab553213c092ef077524ed56fc37da29404c79a7
- SHA512 81b4cec39b03fbeca59781aa54960f0a10a09733634f401d5553e1aaa3ebf12a110c9d555946fcdd70a9cc897514663840745241ad741dc440bb081a12dcf411
- SSDEEP 192:aR1yvxxVRQRrclOniQ14Yvg5bbVFMio1UF9w9P75uaMY+c6RhO1ON6Ql4qRiZ0NO:MyF5XVF61iwZ75/YRhO464z8wdEt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  scripts/tk8.6/text.tcl
- Size 32KB
- SHA256 f26ed909a962d02bc03585a6c756f4fe992c311c7f53648137e427747120b441
- MD5 33230f852aac8a5368aeba1834dcec77
- SHA1 beba97c48a110f4a9fe86f60e5fd4ca6ac55e964
- SHA512 caac54334c4eb439c18f03eeb5de83aa6bbd6bb07b760a40c60f2d34f5ee1fdd542f83ad427059863f96b0a8f2cb96658171a7cd0c0c2c49e002bd02e6d418f6
- SSDEEP 384:Th9XGSuWsNGbWBFFRzGagUNKEFx8wredkG/gVVFaO/2bembFWaHnla98ffRiqiPp:T8zNGuF6uNdyO4OYa98ffRUAlde
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  scripts/tk8.6/tk.tcl
- Size 23KB
- SHA256 3e998b41ab23677db31902e1e876e644b279b2e6d8896443f6c434352801cdd1
- MD5 25094462d2ea6b43133275bf4db31a60
- SHA1 6bb76294e8fdf4d40027c9d1b994f1ab0014b81b
- SHA512 8bdae921f367b864ea7f36c9a549ee870d4e4e3c6e942d70722a84ae6b23ff00a33638d8ca8f3b9b8fe084875ba7c8976975849f4dc47cdb5671df47af68cfab
- SSDEEP 384:dWAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWBL+g190K5TzMSWa:dWOIQulHokh0QzMemB0MCBL+g1bEW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  scripts/tk8.6/tkfbox.tcl
- Size 37KB
- SHA256 ae448df6fdbba45d450abefef12799f8362177b0b9fe06f3ca3cb0eda5e6aa58
- MD5 21985684c432cb918a3e862517842f75
- SHA1 4dbacaeef8454c1b08993d76857c5f09aa75405a
- SHA512 afea6c47001455d7e40a5a7728fa4dfad7bb66b02191e807bb15355847f5b265deee6015516807b10e1273710a3d03faac7856cb16efa773813105b23a11960f
- SSDEEP 384:a6NFLvIIaE2wCpxQYt/rJTkA3NN5YAGnk1c6gHZZgkO0Z6INfdpsaUpWz8ZlhL5S:akJ2wKFXuNzClMGH87f12Vb4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  scripts/tk8.6/ttk/cursors.tcl
- Size 3KB
- SHA256 7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6
- MD5 74596004dfdbf2ecf6af9c851156415d
- SHA1 933318c992b705bf9f8511621b4458ecb8772788
- SHA512 0d600b21db67bf9dadbdd49559573078efb41e473e94124ac4d2551bc10ec764846dc1f7674daa79f8d2a8aeb4ca27a5e11c2f30ede47e3ecee77d60d7842262
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  scripts/tk8.6/ttk/entry.tcl
- Size 16KB
- SHA256 fe32f8b154893218acaba93ac4b8e1170d9b3e3ab66df63df85c0a31c17592be
- MD5 3dea98c515f6f731e666656da9708f12
- SHA1 212865fc5c635eeca380efc1b3fbb85554714c47
- SHA512 2901b5f92df95cbd1ec71acf86646af2f1d6058232eef1b5779192bad6df0bbbbc5902e363f809671f06d13270b1581d55f611556d48b1a843194477a113aeab
- SSDEEP 192:hRy3ALQksU0oayTUQiZxIQzNiQfiEL8QmOhQVqknFoTOXyJtcC1JMuZm4FZxO25t:GoU7viEyOFWiTOEtcC1q252Ezp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  scripts/tk8.6/ttk/menubutton.tcl
- Size 6KB
- SHA256 d9af20135ef1bfeb3e0fd9fdabe821474de3ed43b3745a42fe564d24a8b9fd9c
- MD5 fe89894d8cbf415541a60d77192f0f94
- SHA1 c0716b2d8e24592757b62d24eeed57121b60e00f
- SHA512 66488cbcac49cca47c9c560648e891d429f40e46549f58687b98073eba4807a8458a277be093ebfc50709a8a87a529df4e526eccfb60803ce16af17b97accd3d
- SSDEEP 192:hfbJvnN+PN8JdNHC2yP9ZaOGOVyf1VdYwppcdhXk8dpK+dpKZxD2grrGAInehTOG:hfbRLRJDHco8zFzq6HG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  scripts/tk8.6/ttk/treeview.tcl
- Size 9KB
- SHA256 0e05adf29b616989cb4724e57a26f1044598781f0cc10d5eb5ac4af7d705ddca
- MD5 5bec78db1a86b4bc17a5108806c5371e
- SHA1 4b2b08240f778864c5045f546a620702ae126ccb
- SHA512 29dff439bb5caa23f8f38ea136406fa2db68be021068f80bad2e2ec811ae5c5b08f4f287719db946db780122af05654392ea771fb523bdc1569b364689d3ec86
- SSDEEP 192:ZWeZ5BDFpkj+DsXibSyUMHLCGLdEpTBbZ:AeZ5BhypGKz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  scripts/tk8.6/ttk/ttk.tcl
- Size 4KB
- SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
- MD5 e38b399865c45e49419c01ff2addce75
- SHA1 f8a79cbc97a32622922d4a3a5694bccb3f19decb
- SHA512 285f520b648f5ec70dd79190c3b456f4d6da2053210985f9e2c84139d8d51908296e4962b336894ee30536f09fae84b912bc2abf44a7011620f66cc5d9f71a8c
- SSDEEP 96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  scripts/tk8.6/xmfbox.tcl
- Size 25KB
- SHA256 9c78a976bbc933863fb0e4c23ee62b26f8eb3d7f101d7d32e6768579499e43b1
- MD5 f863b7c5680017ee9f744900cc6c3834
- SHA1 155e6e8752f6d48ef8d32ce2228e17ee58c2768e
- SHA512 34f5b51ea1a2efcd53b51a74e7e9b69fb154e017527bbd1cb3961f1619e74be9d49d0583d193dba7e8a3904f6c7446f278bc7977011dccdaebbe42d71fa5630c
- SSDEEP 384:obPA7Xi6V2+Bec3ipnFH6HZ1KDZvRcbQ3sd1GkjDo413lK/RIV5MXrSomsjiETwM:orA3TVJc3sd1GkF3cIVf591w
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  scripts/vmd/atomselect.tcl
- Size 4KB
- SHA256 2d44af73f0679a52be91c949cafb472cd827749e74436a889194a11ded7e28bb
- MD5 2dd805624be6064887ba426a7db54739
- SHA1 1c24d93d310a67bb4010e4bbde9c6bc79ca2ff00
- SHA512 177c3e86acf51a86cf0f7cacbe65d7e42fa80f3a109f07df82ea0edb2d0859c2d1f1aaeabd3c1eb66597d1bacb8e5fd389fe444f5414a41479be806b6fc4b07b
- SSDEEP 96:CEaC3fwCnr5NQvTxjyntV/RLL2LksPdkNHAXpYK7qS1xxJ+koNH15kkoNr:/aCPwwbQvTotZ92pN5JOSf36e
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  scripts/vmd/biocore.tcl
- Size 3KB
- SHA256 4fd9804c62e76e4e69e1705855d5e5e56b60f5cf0f6f21b46238a438bc57a670
- MD5 6d1f5a629fe2c0e4aca8280c14acec52
- SHA1 2b9bf302989cb124f9c66d78be8773f4f87432be
- SHA512 1225eddc9a0eaa1a6f7d7b56376c6f5685921c75d0939add71e340345d9ba85beb55c62c80ee11d4b268773b3161779f4a66c7c4616a1c827190f2d65bf5d9df
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32