b3be21ee725c02741b2c666a8064db8cffb8bdc9a6d5821f5daaf9d636ae4713

Target

tora_or_software.rar
Size

2.0MB
Sample

240929-tn9rvavalh
MD5

190c47ad6b3e060f7ba5eae3e4602c12
SHA1

ece5801a15160b6654fd4b0c0b8fb9736c00d7bb
SHA256

b3be21ee725c02741b2c666a8064db8cffb8bdc9a6d5821f5daaf9d636ae4713
SHA512

e2579f0fd583c484a9448abf8185d558d817264205abdc66ffd477cea47413a1f97257a1afcee2846c905b4f19e1c9fb4ac22711b27e6ae75afa631fced0617f
SSDEEP

49152:hw705LC0XloHp7LEYCiN0rO2xR9KIIJr/PoAQD9dK2OOM88C:+705LXKBLEDrO2xR9KII5YAO9dtOOMO

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  TORA Operations Research Software/setup.exe
- Size
  
  137KB
- MD5
  
  35561a7acb299a7278e8706fd6e01aa0
- SHA1
  
  41e1f323eb44cb474bf04567bed95f4767502131
- SHA256
  
  978123c86b1cbc981770fbd8bdfc58ef4030f8d9b3adf06b71b928cc0394c073
- SHA512
  
  0d7784c6e9c175027f627b522cafedd87d0f85afb16fb86f9c91a7a045894621e0c9b50d785132e5d5d44c1d21cb76b669960d64212b34c07863039c9b6e499b
- SSDEEP
  
  3072:RqwmOGqM8OROAO5UTS7vdWcoWxg7YjcZJQgh9/J:Rq0M8OQAO5WSocVxgGcj/
Score

7^/10

discovery
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  COMCAT.DLL
- Size
  
  21KB
- MD5
  
  3b180da2b50b954a55fe37afba58d428
- SHA1
  
  c2a409311853ad4608418e790621f04155e55000
- SHA256
  
  96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
- SHA512
  
  cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8
- SSDEEP
  
  384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  COMDLG32.OCX
- Size
  
  137KB
- MD5
  
  d76f0eab36f83a31d411aeaf70da7396
- SHA1
  
  9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
- SHA256
  
  46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
- SHA512
  
  9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
- SSDEEP
  
  3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  DBGRID32.OCX
- Size
  
  513KB
- MD5
  
  ec2f4fce368dade257d89a1bde1de380
- SHA1
  
  7026e068eaaa6c46a29d1cbf50b057a1744d67ce
- SHA256
  
  6cc3e18193118e5d5e0d9a3c765ff2e649a99641b55a79abf1463ed5d46928db
- SHA512
  
  cdf1d5e4d7270a7a582edaf16dfda3253d31df48b3af6e333c716b1459fce3b62c14f8b002e77daa07c5a075b05efd3ba3b7073c45b830d0a86d20f7d22f1f52
- SSDEEP
  
  6144:1RMh9f2cQ02j1bNHu/v/4jk0+zlOMKSHLO7GcrxXkbFmjKUUFoQ/8qY93lsrbB20:vwts08bNHd8lOMKSHLBSxXupY3sPB20
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  MSFLXGRD.OCX
- Size
  
  238KB
- MD5
  
  07bae8106a135df779abc46ec603ea09
- SHA1
  
  be98c98a35da6ced57b7fc3c2fc933efa84b4273
- SHA256
  
  4e592240b745546c15e95e26b2547cec86352a49ee1ef79b3e3d28df8b5a0e70
- SHA512
  
  6ab494ea9e1c633969d5fe6c14411ec20f7073e464e2738c545deefbdc5fb84fb26ff3e9641236cf1afb4d90633437cd312ff5c665c0c8f462c101a957fffbeb
- SSDEEP
  
  6144:vMV3LOqB4GvoBOCzYRpHGbBFYe0SwX6ktCfh13cBvT:vMzaGKOCzYRANKX6kQB67
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  SETUP1.EXE
- Size
  
  280KB
- MD5
  
  e40041e0ca436c712332edaa9db7df08
- SHA1
  
  deb8ead922f4f1acbadebf0db998f6ba2dc53db0
- SHA256
  
  6a15b76e1526e1fd6ebaecacc59c3e954d0feb0b566c81538ea6dad2edcffe16
- SHA512
  
  1111be364c3d81dc919d1e7ba7bd141cda6555844d889f00a2b2cb0ee5c19bd0b122ae4b574a3cdfa268668eebec43fa265b44e1b8fa28faaa335824647b8bc2
- SSDEEP
  
  6144:0uOQemROOMqMA8K3eEGOCUgtLD2J9dh4bYTJ6QKq:3O2OmMQGp2J9+
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  ST6UNST.EXE
- Size
  
  71KB
- MD5
  
  996f83e516552ca3b51445bb994a6d38
- SHA1
  
  56fc6ba49195dedf735e6ce1b03ab36d72334f66
- SHA256
  
  7e60c894a8cead6880fd3ed040504d02304a0b961304e40741340e31f5fa973d
- SHA512
  
  5868100fdb274dbad44ea0996aa4ed0a930cce5c61ce55631869bd19ee09feb8a957bf2a4a87ba563f48bb65807dae5b2363c042d451843e9598b10f6c334d2f
- SSDEEP
  
  1536:hKTg6tZkYVxqdE5NLt3mZCSRCxDka6tg7N4G:IsixsE5b3mZCwC1AtgZ4G
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  VB6STKIT.DLL
- Size
  
  99KB
- MD5
  
  cff867572b44212b01b711c1fa009537
- SHA1
  
  3978c9f7a3d77c0bdff4353949e2143757eebc79
- SHA256
  
  df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b
- SHA512
  
  1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4
- SSDEEP
  
  3072:c6v5KkE3OEc4dUN5KgzIED1LAOWOa+dSogCh:csKkE+Ec4dU/KXEDunOaC
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  asycfilt.dll
- Size
  
  63KB
- MD5
  
  0bc326cd99125724987ceec7405496b6
- SHA1
  
  cfd440400244c182fd064508e873d62529d285f3
- SHA256
  
  e701cb227daa19c9b91ecf9975a12351bc4d73454b894695a6c5f74f65b9b77a
- SHA512
  
  efcad7817908ae1d503e7c1797e190b8b541cda62eb063aba4c96c0e7012803a3f2070cee597122974b84ad6c26c1c5508c57839df07a3fb140b817ef6fa7994
- SSDEEP
  
  1536:3+N9Jz5cgH8fVTikHij8fdShRDGD5XlOB7RegH0zNKl7Q+:c9Jzsfc46hRDm5XgBTUzNKlk+
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  msvbvm60.dll
- Size
  
  1.3MB
- MD5
  
  e949eee7d1be07e32267fe10d9992c38
- SHA1
  
  a4241fd4850a6e2fa36ef788a34283a23b85fbbb
- SHA256
  
  fa75a67b0d6a8829993397c3a893c182641a8c4806bb1e46553dbad7f7aaf5d4
- SHA512
  
  22a789ff7fa41eb739c11a7a9e24f7db86b477650d0c89d937811ebb8a044093019c0728429c9880ee4d76d9bdcaa1d6dbd95ed7b623db619eba0f715586a35c
- SSDEEP
  
  24576:Rc4BJ69cQtOv6iAPEF/HNBqXTG7UOB4JWE3tF+tGpzhkFGz8Jb6:RZX6HtOvOXTG7UNJWE3tFvzj4W
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  oleaut32.dll
- Size
  
  540KB
- MD5
  
  b3742dee858b243e77c73d2b8f7c8223
- SHA1
  
  7a132127eb3efeca8f6bc3f20e49b5011b5ae5df
- SHA256
  
  4397d0fe3ef2cdb85dd811b8743c7700bd4e6d8d3365dcba5286aa10adb2c24a
- SHA512
  
  277f8f2750a562d5f8168c608928d232a3755662628bf7bb9ed17819786a0e7234534f5e028f4e1e0a2bec0468be5c12c56770c60713f06ac96422581fe26774
- SSDEEP
  
  12288:DtppNnzQAuSIeoGuodbAR/Cv7MVDGKVAE0wKKae2M0TK:DnpxzQAWe9/dbq/Cv7MVpWwKKaY0TK
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  olepro32.dll
- Size
  
  81KB
- MD5
  
  b48d3193dd1474dcbcc32bf4779ac698
- SHA1
  
  4a39d43aea0766c159a32c311c9eb2e06dbf8c03
- SHA256
  
  54d7ee1e4b43d2590b3b9b4a412717bfecfcce46f9dda68dba4695f135faa7b5
- SHA512
  
  fdb0691dfb26d43708f8f12f6b75e2097570ba27a0040e0f8ecac30ef9307dedcf425cbec671a0178916675503542a7fa670fb5515ec231509d5aabd0047debb
- SSDEEP
  
  1536:nIjsab9WEkUEAzs11+/nnJZL7aWsuN4kQfWNtMNwTs:Ij99WXmsbUnnL7Sy4kwWTts
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  stdole2.tlb
- Size
  
  17KB
- MD5
  
  0857394e30de11ca0cd9497e310d6469
- SHA1
  
  ba35fba3e44040e7b891fa814dceff94d1c1b114
- SHA256
  
  e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426
- SHA512
  
  05309e02b7c427f379f3235d2d7398d53ee35b3f1f9d7f28ad72607c82e0af6163a2def42734666f7e1fd0b67395031632aff9c9af36fb30c0175fad145f1185
- SSDEEP
  
  192:pMrSEiGPWF0Y3wAQgiQJdDg5rDLWQrNBm5C7BTNcJL8Bz8QFWocqGWcp:pM/uFrR+X6QNn1pcJI5WocqGWcp
Score

1^/10
behavioral25 behavioral26
- Target
  
  tora.exe
- Size
  
  1.1MB
- MD5
  
  2346349fc8e8e6db23c35fb0f87f6bf5
- SHA1
  
  3622e640ea66838282ef9b56596452fbb3e3e20e
- SHA256
  
  9a6e4f75fb820d8bf63d770a9c79f4717d1fc48ffba76940fc4dafa2320881fe
- SHA512
  
  1cf5739e153d13c0a916adafad4e1fe282094eb4688bd194c0453c13a04c0a3e6c8b044650c3d0695a98fb077209ea9c391cedeecc2be43ab542485cc1684078
- SSDEEP
  
  24576:tq1PSCgmkTUFb1XZDa7rRirAVKZhxvzAw8CXZ4VRRDixAAnlmr:8gmeUb1XZyrcUV41eRuyp
Score

3^/10

discovery
behavioral27 behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28