65f963bc3c4466d55ecb3f15295be97eaad188c9c73f4bef241c3bf46d95b4f3

Sharing

Copy URL

Twitter E-mail

General

Target

DungeOfDestiny.exe
Size

68.9MB
Sample

240709-1bmj4sycme
MD5

996c5dba3c8724494a969ae8be2eda46
SHA1

844676bbb09a63c4b59c284dc6c356e58ac19163
SHA256

65f963bc3c4466d55ecb3f15295be97eaad188c9c73f4bef241c3bf46d95b4f3
SHA512

441676b78b247d5e8dbc4f121985ee8ad1b28792114d37c5e551b76b1cb36d51ee43a461ac4da2900cb3730db8420786d1e910ecc952ba6f45395f0515f90df3
SSDEEP

1572864:f/WHHr9M2aYi9toTEwKKwHGMX8FjjPcXoMZVIf7:f/8L9M2U9toorKwmU4XqoMsf7

Score

7^/10

Malware Config

Targets

- Target
  
  DungeOfDestiny.exe
- Size
  
  68.9MB
- MD5
  
  996c5dba3c8724494a969ae8be2eda46
- SHA1
  
  844676bbb09a63c4b59c284dc6c356e58ac19163
- SHA256
  
  65f963bc3c4466d55ecb3f15295be97eaad188c9c73f4bef241c3bf46d95b4f3
- SHA512
  
  441676b78b247d5e8dbc4f121985ee8ad1b28792114d37c5e551b76b1cb36d51ee43a461ac4da2900cb3730db8420786d1e910ecc952ba6f45395f0515f90df3
- SSDEEP
  
  1572864:f/WHHr9M2aYi9toTEwKKwHGMX8FjjPcXoMZVIf7:f/8L9M2U9toorKwmU4XqoMsf7
Score

7^/10

execution persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral7 behavioral8
- Target
  
  Setup.exe
- Size
  
  158.4MB
- MD5
  
  bc727f4f4436b752f42b3f5e80822490
- SHA1
  
  1d0e5426296847c5eafb04a4709da1e53d9547e2
- SHA256
  
  d57c9f9f7f8756ec6147594b74513a546793d3479dd52f73cfe63588601bbc3c
- SHA512
  
  09a825a9054ba5798ccbfd2b42dc06c89db3f2a6a92f93eb33a7edde7196da5baaf81d2b7a972004a2e4885972c999b6ee21c9cb276ea56a9c2fc7c6039f4658
- SSDEEP
  
  1572864:YPD2Ct33+Z58VwrZDI1iKltd4/p3+syaYwYRJ7g2m0j4eZ/OUG02nQ5ixaCUKELg:YeBhZC3YsuL
Score

7^/10

execution persistence spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  ce613fb05afd722fac05a28d6e935cd4
- SHA1
  
  d96ae5969cb134a8686d8ae72be304848a4d1f0e
- SHA256
  
  742c956f892ad0833a5b8c52d19aa69940bc15bedbb42890598df61b263f6fed
- SHA512
  
  c886e1e1e24e4b3320842127a7464a1baae93b0f791c7fff06af3ae1d7c312ae490f7d5f41c6d857b1be9da39c63e468b7ac6493ba7ee9e2ebf5e6344acda7d3
- SSDEEP
  
  49152:k8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFc:+n1H9MDCn6OFMWyBc
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  874b49121773393e5ab748e52c630089
- SHA1
  
  f35c93744cd2f0c178fc250116588654772d1339
- SHA256
  
  d9773c57e821ef87891375d687c68c0be75222316a666e8c49640aad80f60959
- SHA512
  
  ac8a09d44d7242d0e897ea84fa8f3f3c1d0e203fc3c03d5e62fba75f0c5e88189037145fb3548eba54c6c657af9126da96b6fa224dcbebbaa51f84f74dfa427b
- SSDEEP
  
  6144:HI9l960ewE3X883ZrzMkBmi12EvUGsADkIgHc:HClY0WM8JrzMIKOD+
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  47fd3da85f490e65b3252c83c76e63a9
- SHA1
  
  6f799b2d5f1768682cb6d8c2407110410142444e
- SHA256
  
  49ace76d838e02994a03354e557ae65a305d9c5c8441774fa174177451e26dc9
- SHA512
  
  8df107a48ff17000ff0a59139fc545276a12355a052658d933a2681172d5bbabde48b2e17925680a80006587c318876d494096d27f0c41b281e39a5bdbd14fb7
- SSDEEP
  
  98304:Ut5gLbmQACQYA7g4fdYlDOckpKOgeSXwb:UE/AVuDSoo
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral18 behavioral19
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  e53fd0779465c910b275f93abafa6e3e
- SHA1
  
  f38f2711805d08b4b6d29b0a49253db0da939fcd
- SHA256
  
  58e2b5ab33366550207ed8e1f420b24c94b19fbe8e753f5a6c038beb829533a7
- SHA512
  
  934e8e68042d1adcf17efc1fbe728930ecb2d6cbc0fd60ad064e28e18ed2a57fffc7331b2eb807f6972c0c37bb9acc69c97a137b264efab67e180a8fe0d1cdc3
- SSDEEP
  
  49152:z6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKY1:zNZFjAgpOz2VeCCAkEvkCvGZf9z
Score

1^/10
behavioral20 behavioral21
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  5148e286ea76b5c3a01656a84548d035
- SHA1
  
  9f90b7523c64c62d7b0adf4511b49a3f2bb022eb
- SHA256
  
  7fb87a7f0d50007dca64bf845d444fc66116a57edecdd8487c91d6879b578a0f
- SHA512
  
  23527f9eedc4873320c65b91afd90873febce3f666470dbaaa42e1165c4b864f1df19038bb272954eb2281bb103c15199c6ff25ca44c0ecbfebfa1f5b34c01d6
- SSDEEP
  
  24576:wV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7MG3:0t2zNLnxA1+66Z5WoDYsHs6g3P0zAk7v
Score

1^/10
behavioral22 behavioral23
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral24 behavioral25

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

An obfuscated cmd.exe command-line is typically used to evade detection.

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25