24036f23f1be0d4024c16ee49234bbe9df2fbac068ed9df0ed47f56d596d158a

Sharing

Copy URL

Twitter E-mail

General

Target

Crystal-Client-Launcher-setup.exe
Size

62.3MB
Sample

240907-vhr6aawfqd
MD5

a5500512104b581a217258557e64e316
SHA1

047209004cdc244bb26d3429eae157b289d3ccf0
SHA256

24036f23f1be0d4024c16ee49234bbe9df2fbac068ed9df0ed47f56d596d158a
SHA512

f65b11e8b071ba13005d66f796d684811ec83fec366dc3d71a27cb0a4b480d925f7140f6baeb6f81ae46db84630dbd9ed28f93ac7e5b2252f54b252cf52937ec
SSDEEP

1572864:WigU7aTp2fmIqWYIQklIK+Z2m1AoJETV27SlCPZYfDlI0a:WiL7aTp2+IgJMH+Z2m3KTV6SlKZSeN

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  Crystal-Client-Launcher-setup.exe
- Size
  
  62.3MB
- MD5
  
  a5500512104b581a217258557e64e316
- SHA1
  
  047209004cdc244bb26d3429eae157b289d3ccf0
- SHA256
  
  24036f23f1be0d4024c16ee49234bbe9df2fbac068ed9df0ed47f56d596d158a
- SHA512
  
  f65b11e8b071ba13005d66f796d684811ec83fec366dc3d71a27cb0a4b480d925f7140f6baeb6f81ae46db84630dbd9ed28f93ac7e5b2252f54b252cf52937ec
- SSDEEP
  
  1572864:WigU7aTp2fmIqWYIQklIK+Z2m1AoJETV27SlCPZYfDlI0a:WiL7aTp2+IgJMH+Z2m3KTV6SlKZSeN
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  Crystal Client Launcher.exe
- Size
  
  133.2MB
- MD5
  
  f2d952c283c535a6c0247f610d5cf6f2
- SHA1
  
  eddf220e263c4b8610606f538e0b28574ea359f4
- SHA256
  
  8dc40dcd2d9d2c65785999249112fe7729d546f378bd85828a65c29db9078628
- SHA512
  
  9d395fce49cda66e2746abece61ff0d290d43842dcd0a78d4fdb76d145f03d9856ce4f0ad6589bc135700608769fe2b58b798a7f2b64bb64945df70ec761bd4a
- SSDEEP
  
  1572864:P2HVo9Ck+yOBBdJAVwlymAETslfp409t:v9Ctx3tu
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral11 behavioral12
- Target
  
  LICENSES.chromium.html
- Size
  
  5.2MB
- MD5
  
  4247afa6679602da138e41886bcf27da
- SHA1
  
  3bb8c83dc9d5592119675e67595b294211ddbf6e
- SHA256
  
  bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
- SHA512
  
  ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
- SSDEEP
  
  12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  7977f3720aa86e0ec2ad2de44ad42004
- SHA1
  
  04a4ef5ccd72aa5d050cc606a7597a3b388c6400
- SHA256
  
  61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e
- SHA512
  
  8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d
- SSDEEP
  
  49152:baOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:it59uEBm8geZz
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  431KB
- MD5
  
  7b77074945dfe5cf0b1c5a3748058d57
- SHA1
  
  fdea507ac2be491b8ad24ddc1030ea9980c94c0d
- SHA256
  
  994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56
- SHA512
  
  d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd
- SSDEEP
  
  6144:QpKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLVDc2/:QBl1EyyAZvJWM936wOJTWVDc
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.6MB
- MD5
  
  8c93e19281992a00993fc0f09e272917
- SHA1
  
  3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
- SHA256
  
  1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
- SHA512
  
  c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
- SSDEEP
  
  49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  
  swiftshader/libEGL.dll
- Size
  
  445KB
- MD5
  
  be1b6fe26a1b5a3e1302c26ce5ce53f3
- SHA1
  
  c3cac08e89c4cc91eae1cc87e33a1dea723f1d78
- SHA256
  
  162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546
- SHA512
  
  07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55
- SSDEEP
  
  6144:NldwaUBIAHXboKn7YsGfJjjvQppfSH6RdW8wrpGLVgf8q:JWIsXboKnMAfSHChgUq
Score

1^/10
behavioral24 behavioral25
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  3.0MB
- MD5
  
  1e401ccda5b723ab8a595a54f7d2531c
- SHA1
  
  127716680dd16f776b19c2306d716935e54c5100
- SHA256
  
  c167a458174e2a280c39d7af31bd109e8e2921032a687097b584653adc33ab21
- SHA512
  
  1f2f35021f338aa7c5a0ae83c196217fbca6b1d017ac1bb4f1eebb93bd6e18c5d74c1a14bd4899d7a91d054b0139b2c4fc3271c35148ad1d8b71139aff0132fc
- SSDEEP
  
  49152:8NF/tcKnjh4NDNR32u7X5f2yRwT6mcavJ9BtCCp5kVtjjFCo5Z5UbNyJzSZ85C5c:8NIaqrNONEniz7P
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  4.3MB
- MD5
  
  77f7b4f46cb3e06b53729fd1e562dfef
- SHA1
  
  223c09805220ff2b5c1dcbdd5c0396231ea34f11
- SHA256
  
  a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5
- SHA512
  
  6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571
- SSDEEP
  
  49152:ImuXbIxohwCWtm32rw3lYIDkhUw2B2w/XBnbtZNDNHI6iBewVqlnrSrMrXHYtvQi:Ca9dCeKOB
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  715KB
- MD5
  
  25afbdf6701013c57b19b92225920915
- SHA1
  
  009300dd4ab3b81794388ce7d126ae90ff97535f
- SHA256
  
  22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c
- SHA512
  
  575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e
- SSDEEP
  
  12288:oYa8yQ628GMAhXhpt1o9Sc4irKabLqYz/oD4C56:ZgQ6jHAhx71o9WirKaqYDa
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1
  
  eb607467009074278e4bd50c7eab400e95ae48f7
- SHA256
  
  1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- SHA512
  
  7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP
  
  192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Enumerates processes with tasklist

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32