11bf7c54256c89405c7afd1a73baff4d42afd0dfb7e8bb9279c910e12db7acdd

Sharing

Copy URL Twitter E-mail

General

Target
C++.zip
Size 172.2MB
Sample240813-2bm2bazapb
SHA256 11bf7c54256c89405c7afd1a73baff4d42afd0dfb7e8bb9279c910e12db7acdd
MD5 6e91971141109e28c03b07a2cf911ae2
SHA1 eb3cf91471e29023b7d1ce7c53ea18e0b28b0fc8
SHA512 fc98d20c258962c4bf9e19e648117ed596f814eae8ba5ca32a5797bf8304c9cb5ef9e9069e7fcfd23d6724a5c318f5d60ba2ce7ac55b42a75952ba68bc19ca49
SSDEEP 3145728:ah6XfJSXmBmABeJBldM/pDYvc0PBJihuOtosgaopIpdynHtTYyx8YEiyZmNDns0O:akXBF9BeJB3MxDYvc0pJihuO2sGGdynK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  C++.zip
- Size 172.2MB
- SHA256 11bf7c54256c89405c7afd1a73baff4d42afd0dfb7e8bb9279c910e12db7acdd
- MD5 6e91971141109e28c03b07a2cf911ae2
- SHA1 eb3cf91471e29023b7d1ce7c53ea18e0b28b0fc8
- SHA512 fc98d20c258962c4bf9e19e648117ed596f814eae8ba5ca32a5797bf8304c9cb5ef9e9069e7fcfd23d6724a5c318f5d60ba2ce7ac55b42a75952ba68bc19ca49
- SSDEEP 3145728:ah6XfJSXmBmABeJBldM/pDYvc0PBJihuOtosgaopIpdynHtTYyx8YEiyZmNDns0O:akXBF9BeJB3MxDYvc0pJihuO2sGGdynK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  C++/Visual-C-Runtimes-All-in-One-Mar-2020.zip
- Size 86.1MB
- SHA256 7886bdbc9c04cd741672945348e17102855fa531d7fff526ced7e848e4b5c384
- MD5 87e9f23ab4bf8968689f759214408fc2
- SHA1 cdc2428b9cb6fc7f8db696b56f79bfc3df85fc64
- SHA512 de01ffe51429a25696dc8010e288e243b90d04eb34ff5257564ba02d35c508fdd02cccd33c0d040f1dd1cbc13d7123fb9b24bbe438a1cf295b11c82c9bd34ea1
- SSDEEP 1572864:pMshejwZa79tiMll0rEw7/tSkesahqGp/JoZS8vSDT7JpHXrpUcVRiV91pISUeyK:p08ZqFl0f/tSkefw2oI8vSvjrScV4nzV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  install_all.bat
- Size 1016B
- SHA256 26fdb6604becf2812300ff71c220033f0ebab088c7408a6538b768b254d6508f
- MD5 b0bf1e90c7cf6d8271a0f367f0712540
- SHA1 1ff6235e15cb9ffef8f70add81b79ff517c79a5a
- SHA512 74d76ea4d4896e70b486b237bb3d921a3e5acbcd49b672046665d2c87970c1bbd10dd278efb59a65942a30f7ca9c5c7c3f40a54954643190171a3dd10c8a64c1
- MD5 SHA1 SHA512
Score

7^/10

discovery persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  vcredist2005_x64.exe
- Size 3.1MB
- SHA256 b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1
- MD5 abde5e0a22a46434bd0df652a63fff44
- SHA1 c5088da4be3f72b4af2f3156893bf1d2b1f6f6ec
- SHA512 4ebd8971dea1efb9a72fee071694da7c9d8c797b3564cec7e0044d24b01a13009013f4a43719b7e223214a6c43d50d56790751b9e91cd324d40809bf0d605d9f
- SSDEEP 49152:RVgGXsOTkzq69oXxerpduZ6xJftGEkU0oEBL/txTroHENHTpPE6fIr6VAVP04PLJ:R7XFcDehoLtXEBv11TqZl04P5PqE
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  vcredist2005_x86.exe
- Size 2.6MB
- SHA256 d6832398e3bc9156a660745f427dc1c2392ce4e9a872e04f41f62d0c6bae07a8
- MD5 6402438591b548121f54b0706a2c6423
- SHA1 e052789ebad7dc8d6f8505a9295b0576babd125e
- SHA512 c615e6337a9507bfaaff14e23043e206351d48bf7ba1d0c244c4bc8a08f411b4aa27f9a9074a87b320007b3cfca448306752fd343392bdde83b851b0e7daadef
- SSDEEP 49152:OW6IfKsucUSdXRc8jfi8sH9LyrgSnem02SIi7oOBX4twfDI4OzLbT3:RxucUkGwoBrSn9hFi73BV7xO33
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  vcredist2008_x64.exe
- Size 5.0MB
- SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
- MD5 e2ada570911edaaae7d1b3c979345fce
- SHA1 a7c83077b8a28d409e36316d2d7321fa0ccdb7e8
- SHA512 b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8
- SSDEEP 98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  vcredist2008_x86.exe
- Size 4.3MB
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  vcredist2010_x64.exe
- Size 9.8MB
- SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
- MD5 c9d9eebccef20d637f193490cec05e79
- SHA1 15d032d669078aa6f0f7fd1cbf4115a070bd034d
- SHA512 24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6
- SSDEEP 196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  vcredist2010_x86.exe
- Size 8.6MB
- SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- MD5 1801436936e64598bab5b87b37dc7f87
- SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP 196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  vcredist2012_x64.exe
- Size 6.9MB
- SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
- MD5 3c03562b5af9ed347614053d459d7778
- SHA1 1a5d93dddbc431ab27b1da711cd3370891542797
- SHA512 6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75
- SSDEEP 98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral19 behavioral20
- Target
  vcredist2012_x86.exe
- Size 6.3MB
- SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
- MD5 7f52a19ecaf7db3c163dd164be3e592e
- SHA1 96b377a27ac5445328cbaae210fc4f0aaa750d3f
- SHA512 60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
- SSDEEP 196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral21 behavioral22
- Target
  vcredist2013_x64.exe
- Size 6.9MB
- SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
- MD5 49b1164f8e95ec6409ea83cdb352d8da
- SHA1 1194e6bf4153fa88f20b2a70ac15bc359ada4ee2
- SHA512 29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60
- SSDEEP 196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral23 behavioral24
- Target
  vcredist2013_x86.exe
- Size 6.2MB
- SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
- MD5 38a1b890ce847167d16567cf7b7a5642
- SHA1 0f5d66bcaf120f2d3f340e448a268fe4bbf7709d
- SHA512 907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd
- SSDEEP 196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral25 behavioral26
- Target
  vcredist2015_2017_2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral27 behavioral28
- Target
  vcredist2015_2017_2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral29 behavioral30
- Target
  C++/install_all.bat
- Size 1016B
- SHA256 26fdb6604becf2812300ff71c220033f0ebab088c7408a6538b768b254d6508f
- MD5 b0bf1e90c7cf6d8271a0f367f0712540
- SHA1 1ff6235e15cb9ffef8f70add81b79ff517c79a5a
- SHA512 74d76ea4d4896e70b486b237bb3d921a3e5acbcd49b672046665d2c87970c1bbd10dd278efb59a65942a30f7ca9c5c7c3f40a54954643190171a3dd10c8a64c1
- MD5 SHA1 SHA512
Score

7^/10

discovery persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29