3a660bceeed2cbc8abb64646f0aa603b63ba7a1cf3c31748ef1206089203dcd9

Sharing

Copy URL

Twitter E-mail

General

Target

3a660bceeed2cbc8abb64646f0aa603b63ba7a1cf3c31748ef1206089203dcd9
Size

2.0MB
Sample

240719-q78r4svarl
MD5

d5504c55bc50e4a20ea0e097de173bfb
SHA1

f5fbda66a4b02f8cee65a563b75ef76cd43fdc43
SHA256

3a660bceeed2cbc8abb64646f0aa603b63ba7a1cf3c31748ef1206089203dcd9
SHA512

21a9b85e72fc12007d6b438a7b8740891723a079a977f517d5bb357b94a749087ffb826323570be73a106ee179857129ed8d024326000e5c9086fd4917d71be0
SSDEEP

49152:l1o8xE87vxpsrFpIvPBDurAa7sCYLNDCcaH:ltPN+TIvy7yo9

Score

7^/10

Malware Config

Targets

- Target
  
  3a660bceeed2cbc8abb64646f0aa603b63ba7a1cf3c31748ef1206089203dcd9
- Size
  
  2.0MB
- MD5
  
  d5504c55bc50e4a20ea0e097de173bfb
- SHA1
  
  f5fbda66a4b02f8cee65a563b75ef76cd43fdc43
- SHA256
  
  3a660bceeed2cbc8abb64646f0aa603b63ba7a1cf3c31748ef1206089203dcd9
- SHA512
  
  21a9b85e72fc12007d6b438a7b8740891723a079a977f517d5bb357b94a749087ffb826323570be73a106ee179857129ed8d024326000e5c9086fd4917d71be0
- SSDEEP
  
  49152:l1o8xE87vxpsrFpIvPBDurAa7sCYLNDCcaH:ltPN+TIvy7yo9
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/CommandLine.dll
- Size
  
  68KB
- MD5
  
  a68e017222aea5d2ec74111404e908d0
- SHA1
  
  b6afde07da7e8d4c92e44424cf69269369bc4815
- SHA256
  
  db072dafd56c8e71353ba12ecf5751723c65e56db70b90c57fc979850da7ea2d
- SHA512
  
  c8526970c5288dd6b9bd44f8a2a25e8b22565e2cbb5d77e70e866d9ce19e468a879501a8f29dc7bd60e259688d421c879f894510c75934b4b23ca24488f6ef34
- SSDEEP
  
  1536:UZj9JT17qpL/6ePMqBNzrstoJSkrjbgbwzis3hwb7PT3hm+:Ux9JT17WPMqBNWAkbwzi7bg+
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/DotNetZip.dll
- Size
  
  467KB
- MD5
  
  190e712f2e3b065ba3d5f63cb9b7725e
- SHA1
  
  75c1c8dd93c7c8a4b3719bb77c6e1d1a1620ae12
- SHA256
  
  6c512d9943a225d686b26fc832589e4c8bef7c4dd0a8bdfd557d5d27fe5bba0f
- SHA512
  
  2b4898d2d6982917612d04442807bd58c37739b2e4b302c94f41e03e685e24b9183b12de2057b3b303483698ad95e3a37795e6eb6d2d3b71e332b59deeca7d02
- SSDEEP
  
  6144:GuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/Wo0k:UQL32ikCaUS4csRBse6sfWNk
Score

1^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/INetC.dll
- Size
  
  24KB
- MD5
  
  640bff73a5f8e37b202d911e4749b2e9
- SHA1
  
  9588dd7561ab7de3bca392b084bec91f3521c879
- SHA256
  
  c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- SHA512
  
  39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP
  
  384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/Microsoft.Win32.TaskScheduler.dll
- Size
  
  124KB
- MD5
  
  bf09b9817f5a6984ca30651a77aeb365
- SHA1
  
  4efb5fe37f75b9d5542925c2c729e2c613f84fc3
- SHA256
  
  440adf69b0ebdc0b76afebe2f4bf38757584aa8a79fe5998d339bb8dd12a948c
- SHA512
  
  2b13177070bb7bc747b154b12d7c8fc0b7f0c7c73958499235e02e9e64384b3591a9538749affc81991db32b4db0b1a6c42cedc65ac08ecd15b8636ae7bdb124
- SSDEEP
  
  3072:VBCeNh/pcfnLq3wyXYsKRNRwxz+gT37teucRpH008:VB/w4xQWOG
Score

1^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/Newtonsoft.Json.dll
- Size
  
  692KB
- MD5
  
  98cbb64f074dc600b23a2ee1a0f46448
- SHA1
  
  c5e5ec666eeb51ec15d69d27685fe50148893e34
- SHA256
  
  7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
- SHA512
  
  eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
- SSDEEP
  
  12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
Score

1^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/OWInstaller.exe
- Size
  
  298KB
- MD5
  
  664fa65707954e3e3b6b7f67dfbcbeaf
- SHA1
  
  df8aa34ee94968d7bdd3e834bb15a45386519da5
- SHA256
  
  d895144b6393be39c6cbc4c3b67e99ac5f04472a58ffc07fb067800607c6ca4a
- SHA512
  
  eecfa11a80ecaacb090db4595a0ee82b3ee8ed9afdb070142f74ebc7ea0289a8b73c3f34fcd2fea0b9214296fce4d2045f3fa8e34c551e3a0e79d9eca43cc49e
- SSDEEP
  
  6144:BpatEos7zVZxA7iJ7TUOgFR5Ru09bFyoSIm9006zq29Slplkucq4:BpatqzVZB7IOgF7YFoSU0oSKh
Score

5^/10

persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/OverWolf.Client.CommonUtils.dll
- Size
  
  645KB
- MD5
  
  4ede0a9a0c751563ab155934d9662b69
- SHA1
  
  10d4e31b6ef865f8ffe9f1e02384b4d9f462ca9a
- SHA256
  
  c9d29eb4d36152fa2841d2684c8f1769edcc50af6759712ad591b9a04b3d1622
- SHA512
  
  fe83de892d0c1ce8e4188ba6d2edf2b1e234065de3477bc7d09049c36ca011330a2785063a268a7e855cb2f521fda4b1a741f1a0f68e3c5e7b83fd547327e0e2
- SSDEEP
  
  12288:TITQrrPbOtLhAQR0tYu1HWrw1B1F/Tw25W0CB:It4tY4WqHwf0CB
Score

1^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/SharpRaven.dll
- Size
  
  80KB
- MD5
  
  c5d79f6248a8e360e21fb1978032e009
- SHA1
  
  64644020bdeaae3a5ef37cf406a6d041ba02470d
- SHA256
  
  23d1590ca13f9bc7d6ce53a5cd5087f65d424172716de0809e61207640175275
- SHA512
  
  e133802b1e6d759283229349821776ef54efce7d7ee854b31d967ad09b5b54f548e374d6c9cee6f4a215ac6a2e4f6cdbdde17045f6da9b4722f9ff66b414e6f4
- SSDEEP
  
  1536:qa9qjviI1YjOrfRK9bvyyfpHbnzDwkN7PI3h3b:qEuqI1lRKbvyyB7nlNgb
Score

1^/10
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  7399323923e3946fe9140132ac388132
- SHA1
  
  728257d06c452449b1241769b459f091aabcffc5
- SHA256
  
  5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- SHA512
  
  d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP
  
  192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
Score

3^/10
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/UserInfo.dll
- Size
  
  4KB
- MD5
  
  9301577ff4d229347fe33259b43ef3b2
- SHA1
  
  5e39eb4f99920005a4b2303c8089d77f589c133d
- SHA256
  
  090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
- SHA512
  
  77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79
Score

3^/10
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/app/cmp.html
- Size
  
  5KB
- MD5
  
  d7b8b31b190e552677589cfd4cbb5d8e
- SHA1
  
  09ffb3c63991d5c932c819393de489268bd3ab88
- SHA256
  
  6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- SHA512
  
  32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP
  
  48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
Score

1^/10
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/app/index.html
- Size
  
  20KB
- MD5
  
  c7b752acf6d1e10f3aca2c67b1ccf4d3
- SHA1
  
  ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7
- SHA256
  
  69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc
- SHA512
  
  120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576
- SSDEEP
  
  192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL
Score

1^/10
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/app/js/app.js
- Size
  
  21KB
- MD5
  
  f718bd3f18dd499612623852cd2a2135
- SHA1
  
  9432b7898f655fbbd8132f4b3f8822959ae3ff97
- SHA256
  
  a14fcaf11a16ad7d904960538ca35d5b05e1c1b6a916f228db6b319c6195acbb
- SHA512
  
  90a697f93f239e8210ad47b6f012d3b40ea9c23a92ab909434d0e2d71bc3d9663d1aa73c64646e3dbf417f9636d1190b3d0cf20d349456dee6b6b8d5536d0338
- SSDEEP
  
  384:4X+acDQrcljKdZGb9plmt902wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+acDQYlOdEbdmXH3A4nzIAnGifG11RL
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/app/js/block_inputs.js
- Size
  
  789B
- MD5
  
  b5b52c92b90f4283a761cb8a40860c75
- SHA1
  
  7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA256
  
  f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- SHA512
  
  16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size
  
  324KB
- MD5
  
  1de143ca1babd3c02744f478c8c05c5f
- SHA1
  
  ac918b3d2d5f9cbd9e3b3f5e075ce3c96eec16b3
- SHA256
  
  7fbc3a088ec303143109e0c1b2c04f4c5a6e450a2d6f3071fefb66e92f643ea0
- SHA512
  
  6e419e11f35a3258124127970961907ed8fe0619f618a4c15542ee7f8a01a9f4a7af4d290b634444d21b823ca1afea65f97d5788fff6665d55c2231214edff24
- SSDEEP
  
  3072:LWYyrzt6yrtky1UDtDkNdAOoSPGYTckZtVPuuXheQ:oF6yrKD5kNYYTcIp
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32