Overview

overview

7

Static

static

3

Microsoft ...up.dll

windows7-x64

4

Microsoft ...up.dll

windows10-2004-x64

4

Microsoft ...32.dll

windows7-x64

4

Microsoft ...32.dll

windows10-2004-x64

4

Microsoft ...te.dll

windows7-x64

3

Microsoft ...te.dll

windows10-2004-x64

3

Microsoft ...up.exe

windows7-x64

7

Microsoft ...up.exe

windows10-2004-x64

7

Microsoft ...ll.bat

windows7-x64

7

Microsoft ...ll.bat

windows10-2004-x64

7

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Microsoft ...86.exe

windows7-x64

3

Microsoft ...86.exe

windows10-2004-x64

3

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Microsoft ...86.exe

windows7-x64

7

Microsoft ...86.exe

windows10-2004-x64

7

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Microsoft ...86.exe

windows7-x64

7

Microsoft ...86.exe

windows10-2004-x64

7

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Microsoft ...86.exe

windows7-x64

7

Microsoft ...86.exe

windows10-2004-x64

7

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Microsoft ...86.exe

windows7-x64

7

Microsoft ...86.exe

windows10-2004-x64

7

Microsoft ...64.exe

windows7-x64

7

Microsoft ...64.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Requerimientos.rar

  • Size

    84.4MB

  • Sample

    240805-pekn5szamh

  • MD5

    2dc7e80f4d8d3e9061a967a0c1f31372

  • SHA1

    6896327dded2c24099be20e40e15840c80861cfd

  • SHA256

    6d1816a16faf2f4c08172633a3849a9d8688ae6519f87a8c8cbffd307cfdb90d

  • SHA512

    7c7f9ce8e82a86de1e4059b5bf476a7f9669b9e15935d5b7ac1c80cb248acbb27478ff49d56f40c1f877b41d4c969e3cc083b0069b41d997a997f28cd6a3d965

  • SSDEEP

    1572864:E7rh241rox/yDRocQOxQvxms7TH6tclBaiqIX89jKrgF3a8blH3LR3wKrFHcFEsZ:EfXK6DRBCxmWzvFpX89jSR8blH393wKi

Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      Microsoft DirectX/dsetup.dll

    • Size

      93KB

    • MD5

      984cad22fa542a08c5d22941b888d8dc

    • SHA1

      3e3522e7f3af329f2235b0f0850d664d5377b3cd

    • SHA256

      57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308

    • SHA512

      8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

    • SSDEEP

      1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa

    Score
    4/10
    discovery
    behavioral1behavioral2

    • Target

      Microsoft DirectX/dsetup32.dll

    • Size

      1.5MB

    • MD5

      a5412a144f63d639b47fcc1ba68cb029

    • SHA1

      81bd5f1c99b22c0266f3f59959dfb4ea023be47e

    • SHA256

      8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6

    • SHA512

      2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

    • SSDEEP

      24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV

    Score
    4/10
    discovery
    behavioral3behavioral4

    • Target

      Microsoft DirectX/dxupdate.dll

    • Size

      173KB

    • MD5

      a2a0da126c1a2f8b615b363e862989a2

    • SHA1

      7716675d561b939f8bd22306d05e9671c7da0014

    • SHA256

      300abf15fc1b38373053b898ad9a57098fa5656f26325f45b3d644befa74d428

    • SHA512

      4b428749e2f207a2d7f3ccc5fc6c53a07a17f8f7b6055596531e0e71f4f2932494fe9f751e4251fb559931a91379f2f0504ac218f3c77127434d4abb9e869c73

    • SSDEEP

      3072:xp6LK2/wRi/9S7BLpKG/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTH6KaY:ywRaI3rfuFVeNgosUBxra4rIZsqq

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Microsoft DirectX/dxwsetup.exe

    • Size

      515KB

    • MD5

      ac3a5f7be8cd13a863b50ab5fe00b71c

    • SHA1

      eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9

    • SHA256

      8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da

    • SHA512

      c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba

    • SSDEEP

      3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral7behavioral8

    • Target

      Microsoft Visual C++/install_all.bat

    • Size

      952B

    • MD5

      d9ea81387ab9eda9ca3d6b5abc617877

    • SHA1

      6d0a1ed13d2e7e14bce51993e6e59e433ad58e86

    • SHA256

      84e57c95fb1c5364cff4444fac99629d9c780b4cbbb693878ca559c697e85715

    • SHA512

      94ede29821e7c4da1b46cb879c552fd7bb57b04cc010022d7b1a55ef313e2cfd528cbcde614097c48864fd540b8f06172da35ac19ae4d057ea5c071742398720

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral10behavioral9

    • Target

      Microsoft Visual C++/vcredist2005_x64.exe

    • Size

      4.1MB

    • MD5

      524da2fb61a1361e77704e9466bcd74e

    • SHA1

      90a3d2a139c1a106bfccd98cbbd7c2c1d79f5ebe

    • SHA256

      bb9e8606e26c2b76984252182f7db0d6e9108b204b81d2a7b036c9b618c1f9f1

    • SHA512

      78a29872ed0a6fd871bc31ca23c579204705ba1bca997e55267889b41f93679b025f4e77c68e012eb49e4e9807809039ce6c446148f3ad4e6176dd6d2ad2bfdb

    • SSDEEP

      98304:y4+PG8W44ij9RvbGOZUR241QZgC51B+PRPM:yPG8W4HhbVURp11CjgJM

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12

    • Target

      Microsoft Visual C++/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      8649837a592f6b4f9235bfb7fb3f5c93

    • SHA1

      ae4b15e3677a4f5a711ddad84085b885945ddb0d

    • SHA256

      c615d7454875949fd969f95f114e168fbe8867c01f1a7db632f54f53c2ebe75c

    • SHA512

      b1d8a8099a17ad2d82da3a2ea8f5f572166382892118a728de07caa36838ec0f528d5c140fa3cde70b08608947ac30d4935618cc5a36340e5b41cae83ab0bfe4

    • SSDEEP

      49152:kqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazkiWaR:kxxLFfY/KCCpKk9aWMzZyad

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      Microsoft Visual C++/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral15behavioral16

    • Target

      Microsoft Visual C++/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral17behavioral18

    • Target

      Microsoft Visual C++/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20

    • Target

      Microsoft Visual C++/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral21behavioral22

    • Target

      Microsoft Visual C++/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23behavioral24

    • Target

      Microsoft Visual C++/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral25behavioral26

    • Target

      Microsoft Visual C++/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral27behavioral28

    • Target

      Microsoft Visual C++/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral29behavioral30

    • Target

      Microsoft Visual C++/vcredist2015_x64.exe

    • Size

      14.4MB

    • MD5

      be433764fa9bbe0f2f9c654f6512c9e0

    • SHA1

      b87c38d093872d7be7e191f01107b39c87888a5a

    • SHA256

      40ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed

    • SHA512

      8a050ebd392654ce5981af3d0bf99107bfa576529bce8325a7ccc46f92917515744026a2d0ea49afb72bbc4e4278638a0677c6596ad96b7019e47c250e438191

    • SSDEEP

      393216:0+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS:0upttD7yBG/PcXU9g5

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Event Triggered Execution

2
T1546

Installer Packages

2
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Event Triggered Execution

2
T1546

Installer Packages

2
T1546.016

Defense Evasion

Modify Registry

2
T1112

System Binary Proxy Execution

2
T1218

Msiexec

2
T1218.007

Credential Access

Discovery

System Location Discovery

16
T1614

System Language Discovery

16
T1614.001

Query Registry

13
T1012

Peripheral Device Discovery

4
T1120

System Information Discovery

7
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

discovery
Score
4/10

behavioral2

discovery
Score
4/10

behavioral3

discovery
Score
4/10

behavioral4

discovery
Score
4/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
7/10

behavioral8

discovery
Score
7/10

behavioral9

discoverypersistenceprivilege_escalation
Score
7/10

behavioral10

discoverypersistenceprivilege_escalation
Score
7/10

behavioral11

discoverypersistenceprivilege_escalation
Score
7/10

behavioral12

discoverypersistenceprivilege_escalation
Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
7/10

behavioral18

discovery
Score
7/10

behavioral19

discovery
Score
7/10

behavioral20

discovery
Score
7/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
7/10

behavioral24

discovery
Score
7/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
7/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
7/10

behavioral30

discovery
Score
7/10

behavioral31

discovery
Score
7/10

behavioral32

discovery
Score
7/10