Overview

overview

7

Static

static

3

lorsch.exe

windows7-x64

7

lorsch.exe

windows10-2004-x64

7

$PLUGINSDI...nt.exe

windows7-x64

1

$PLUGINSDI...nt.exe

windows10-2004-x64

1

$PLUGINSDI...re.dll

windows7-x64

1

$PLUGINSDI...re.dll

windows10-2004-x64

1

$PLUGINSDI...ms.dll

windows7-x64

1

$PLUGINSDI...ms.dll

windows10-2004-x64

1

$PLUGINSDI...pf.dll

windows7-x64

1

$PLUGINSDI...pf.dll

windows10-2004-x64

1

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    lorsch.exe

  • Size

    267KB

  • Sample

    240912-taqf2ssdrl

  • MD5

    345792c51d421f3d1f20a1abeec90999

  • SHA1

    902196e5af2f3c838505f28647fa9032ec8c9f93

  • SHA256

    898ad597a28c6b24af67f5c64c9d01a9c19e7457c1e84908fa5cfbf666449ce8

  • SHA512

    e55bd067397754dc69399c437eb39d900f833d2cf4579c4f298f0c3f126ad5d9d2d5e0dd07c1dfa821df0be955fae8508e2d7a1c89ba2e780e2d80b5aa4a1bf3

  • SSDEEP

    6144:wGpoYkk4prkwyIuvrhVgSV/aPj2iiibLmQOYKqklUjkr:wGmkdPv1VgS/AZ9OYr0

Score
7/10
discovery

Malware Config

Targets

    • Target

      lorsch.exe

    • Size

      267KB

    • MD5

      345792c51d421f3d1f20a1abeec90999

    • SHA1

      902196e5af2f3c838505f28647fa9032ec8c9f93

    • SHA256

      898ad597a28c6b24af67f5c64c9d01a9c19e7457c1e84908fa5cfbf666449ce8

    • SHA512

      e55bd067397754dc69399c437eb39d900f833d2cf4579c4f298f0c3f126ad5d9d2d5e0dd07c1dfa821df0be955fae8508e2d7a1c89ba2e780e2d80b5aa4a1bf3

    • SSDEEP

      6144:wGpoYkk4prkwyIuvrhVgSV/aPj2iiibLmQOYKqklUjkr:wGmkdPv1VgS/AZ9OYr0

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Communicant.exe

    • Size

      36KB

    • MD5

      5baa7fd6ce32f0e2843a71bf65f067cf

    • SHA1

      d05552e4209f50a0407cde3c4f9f842b3903d9e1

    • SHA256

      d14d1c1ea5c37231a5d34dcadf0258f6f01d61f33f1a2f63a9cd34d695f3a974

    • SHA512

      45a7681bd4c3e769f32a3481d9b7b913025c151c372774af889c0fa2abb2a36c7a4ac56a082dd777aa4746a55dfe8f22cd129fba887c2263eff47753f2515465

    • SSDEEP

      768:+nbGuTvm7OaPSPNsDhFfVwaZMSGeIsJzXJMgAqzBiub:+bGWvm7OaPSVsDhFfVwaZOJsJzXJVAGP

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/Microsoft.Web.WebView2.Core.dll

    • Size

      268KB

    • MD5

      cd1647080f6ed930927763ced34e953a

    • SHA1

      a6c6bee60f0526961bea39b607a291536d5ff52c

    • SHA256

      2499aa531037203d2a81698ce6aa0098f355e98fef1e62fec110e89e0b830bd4

    • SHA512

      44a7830a1819d6d8284d5391c2c1c5acd98681cb606d5ca6c4e56ba87721ac753f7d7b8058c79d5a388fef0ad91beba4f2ed4d397d612dd316ec6b19d700a4b3

    • SSDEEP

      6144:liQL/+gN6AMIh/heR9pRFIEIEEICepM1S2LQQs1hP09IEeCk61hLvhP/SO0YO9fN:FwAfhpeR9pRFIEIEEICepM1S2LQQs1hz

    Score
    1/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/Microsoft.Web.WebView2.WinForms.dll

    • Size

      32KB

    • MD5

      4232ac1b301b5b7604ccc55dec303a79

    • SHA1

      f042093abe2d1787a66a94db68aaa059482276b6

    • SHA256

      f674d0347bbb90d65f577b74c8bc0375319ada72ec5110b87683a68b7c6e3886

    • SHA512

      eb1b926aff6a4f14b114ecee37c03a54367e6b4426fd93822882a7938905ca6afd4c45eb60a7bd9e0a2cf72694e092899887ee978b4f6628cba45a18149148ff

    • SSDEEP

      768:8W8ALuCldJ6W6RtHZDgcUN5P4JVrnh2jwSvsuTv1JKa5/Zi/6LkuboOzd2nLAAaE:n8Ay+dM9tHZDgcUN5P4JVrnawSvsu718

    Score
    1/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/Microsoft.Web.WebView2.Wpf.dll

    • Size

      38KB

    • MD5

      a4bb580e9b2fff5b90daf6539db212cf

    • SHA1

      88d189915749576eb7bf957032e24f66dc3fbfa9

    • SHA256

      53f1936edd8650659349fa9d0d5182f5f849ee60dfcda3cfb46de99c1676cba2

    • SHA512

      8759945556ef5cac6d55e013f7ed441682e51861629dc649a2c2fa2821dc280692251b0700dccea1193c92fe53c1ca5c74f16537b3b1e798198403c5b415474a

    • SSDEEP

      768:58yYWCsRw80C3/KEWA+a1K8wDP/ryER0mBO4JVrDXh2jUfUPLkq7FKKa5/Bi/hGz:ObOw80Y/mSK8wDP/ryER0mBO4JVrDXay

    Score
    1/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/WebView2Loader.dll

    • Size

      135KB

    • MD5

      bceebc73cb9e3f239b99575c0d38951c

    • SHA1

      d71033e74b44ae5584b6be1d4cc99e4094f5aadf

    • SHA256

      f86b7be36295297de21bffccfde3cef776e175478592b4b16c3063b420723312

    • SHA512

      2cac4b095a46ab625ba7e4c9297133df1ccf3e87eb45938fc65c3ffe6cac31204229f3f4cedc6e58244bf74c76fbe9f2fda7710c784c79814e5ee2ccfb1994e7

    • SSDEEP

      3072:Wgr7UX5RelwF0r8VjiDreFeQV9g3esATVEt6mpoP7GwlYWLk:NwF0rM+DS8QbEtlyP7Gb

    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks