Overview

overview

7

Static

static

3

EasyBCD2.4 (1).exe

windows7-x64

7

EasyBCD2.4 (1).exe

windows10-2004-x64

7

$0/The Neo...es.url

windows7-x64

1

$0/The Neo...es.url

windows10-2004-x64

1

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

EasyBCD.exe

windows7-x64

1

EasyBCD.exe

windows10-2004-x64

1

NeoSmart.L...on.dll

windows7-x64

1

NeoSmart.L...on.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

bin/BootGrabber.exe

windows7-x64

3

bin/BootGrabber.exe

windows10-2004-x64

3

bin/NST Do...er.exe

windows7-x64

1

bin/NST Do...er.exe

windows10-2004-x64

1

bin/NetTest.exe

windows7-x64

3

bin/NetTest.exe

windows10-2004-x64

3

bin/UtfRedirect.exe

windows7-x64

1

bin/UtfRedirect.exe

windows10-2004-x64

3

bin/bcdboot.exe

windows10-2004-x64

3

bin/bcdedit.exe

windows7-x64

3

bin/bcdedit.exe

windows10-2004-x64

3

bin/bootsect.exe

windows7-x64

3

bin/bootsect.exe

windows10-2004-x64

3

bin/udefra...el.dll

windows7-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    EasyBCD2.4 (1).exe
  • Size 2.2MB
  • Sample240802-2latqstclp
  • SHA256 0a94a43af2db7bdbada87b34bf03d3b221110d1ca21bbebec55b08767c1281cc
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasiontrojan

Malware Config

Targets

    • Target
      EasyBCD2.4 (1).exe
    • Size 2.2MB
    • SHA256 0a94a43af2db7bdbada87b34bf03d3b221110d1ca21bbebec55b08767c1281cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryevasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2
    • Target
      $0/The NeoSmart Files.url
    • Size 167B
    • SHA256 1e0d489906665211f71ebc85f030c052fc9f433973e6fb3acc2fc11b01388115
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 21KB
    • SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      EasyBCD.exe
    • Size 965KB
    • SHA256 6a6e16c176004128b918ef3f9ecf1d51d828e6099fba6542b5ac6abdb67c1030
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      NeoSmart.Localization.dll
    • Size 25KB
    • SHA256 3a56005b2efb34620019ef432fe90eeb63726fc78b37be841f25c2aed82eb1db
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Newtonsoft.Json.dll
    • Size 472KB
    • SHA256 4a56ef352f84ad19c1b4486c7c9e64fef9a67c464c62e51bababa79cd2d89551
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      bin/BootGrabber.exe
    • Size 183KB
    • SHA256 f9842333f0b562b4ab5349a09fc173b0b2971c1f600502c4284781c78a735d7e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      bin/NST Downloader.exe
    • Size 18KB
    • SHA256 b92b2fa8916c78ccffef058d3be900c840cb996028d373ba55985fd1d1dddac8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      bin/NetTest.exe
    • Size 11KB
    • SHA256 c35b26223b07d81e9ab638b52e5344d33e10df874457a7b1cfbda6f591a07c7f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      bin/UtfRedirect.exe
    • Size 189KB
    • SHA256 5a87d9485f6e13ee2c3ba4ac289a3e237d17a43ed428b8a5bd5f00fc4800d1ac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      bin/bcdboot.exe
    • Size 142KB
    • SHA256 9898f537b8d3097a05b42f42523cd66fca7c020e8083edbe461e6d9a12dd168e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27
    • Target
      bin/bcdedit.exe
    • Size 317KB
    • SHA256 8bf1b71182fed18d6b4112bdc4d496800b5bf6681de4c4f6536ba67378f38a12
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral28behavioral29
    • Target
      bin/bootsect.exe
    • Size 107KB
    • SHA256 f15e3c9a8f73c6dc4ea8f0a174915b6edca06c75332eec8a28e7a4b347276d4d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral30behavioral31
    • Target
      bin/udefrag-kernel.dll
    • Size 46KB
    • SHA256 0233af69b35decefdc7bb9ab7c8732434ebd4880c3b18085e6116f28431e3d4b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoveryevasiontrojan
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

Score
1/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10