b3be21ee725c02741b2c666a8064db8cffb8bdc9a6d5821f5daaf9d636ae4713

Target
tora_or_software.rar
Size 2.0MB
Sample240930-t8tlcsvgjk
SHA256 b3be21ee725c02741b2c666a8064db8cffb8bdc9a6d5821f5daaf9d636ae4713
MD5 190c47ad6b3e060f7ba5eae3e4602c12
SHA1 ece5801a15160b6654fd4b0c0b8fb9736c00d7bb
SHA512 e2579f0fd583c484a9448abf8185d558d817264205abdc66ffd477cea47413a1f97257a1afcee2846c905b4f19e1c9fb4ac22711b27e6ae75afa631fced0617f
SSDEEP 49152:hw705LC0XloHp7LEYCiN0rO2xR9KIIJr/PoAQD9dK2OOM88C:+705LXKBLEDrO2xR9KII5YAO9dtOOMO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Targets

- Target
  TORA Operations Research Software/setup.exe
- Size 137KB
- SHA256 978123c86b1cbc981770fbd8bdfc58ef4030f8d9b3adf06b71b928cc0394c073
- MD5 35561a7acb299a7278e8706fd6e01aa0
- SHA1 41e1f323eb44cb474bf04567bed95f4767502131
- SHA512 0d7784c6e9c175027f627b522cafedd87d0f85afb16fb86f9c91a7a045894621e0c9b50d785132e5d5d44c1d21cb76b669960d64212b34c07863039c9b6e499b
- SSDEEP 3072:RqwmOGqM8OROAO5UTS7vdWcoWxg7YjcZJQgh9/J:Rq0M8OQAO5WSocVxgGcj/
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  COMCAT.DLL
- Size 21KB
- SHA256 96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
- MD5 3b180da2b50b954a55fe37afba58d428
- SHA1 c2a409311853ad4608418e790621f04155e55000
- SHA512 cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8
- SSDEEP 384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  COMDLG32.OCX
- Size 137KB
- SHA256 46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
- MD5 d76f0eab36f83a31d411aeaf70da7396
- SHA1 9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
- SHA512 9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
- SSDEEP 3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  DBGRID32.OCX
- Size 513KB
- SHA256 6cc3e18193118e5d5e0d9a3c765ff2e649a99641b55a79abf1463ed5d46928db
- MD5 ec2f4fce368dade257d89a1bde1de380
- SHA1 7026e068eaaa6c46a29d1cbf50b057a1744d67ce
- SHA512 cdf1d5e4d7270a7a582edaf16dfda3253d31df48b3af6e333c716b1459fce3b62c14f8b002e77daa07c5a075b05efd3ba3b7073c45b830d0a86d20f7d22f1f52
- SSDEEP 6144:1RMh9f2cQ02j1bNHu/v/4jk0+zlOMKSHLO7GcrxXkbFmjKUUFoQ/8qY93lsrbB20:vwts08bNHd8lOMKSHLBSxXupY3sPB20
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  MSFLXGRD.OCX
- Size 238KB
- SHA256 4e592240b745546c15e95e26b2547cec86352a49ee1ef79b3e3d28df8b5a0e70
- MD5 07bae8106a135df779abc46ec603ea09
- SHA1 be98c98a35da6ced57b7fc3c2fc933efa84b4273
- SHA512 6ab494ea9e1c633969d5fe6c14411ec20f7073e464e2738c545deefbdc5fb84fb26ff3e9641236cf1afb4d90633437cd312ff5c665c0c8f462c101a957fffbeb
- SSDEEP 6144:vMV3LOqB4GvoBOCzYRpHGbBFYe0SwX6ktCfh13cBvT:vMzaGKOCzYRANKX6kQB67
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  SETUP1.EXE
- Size 280KB
- SHA256 6a15b76e1526e1fd6ebaecacc59c3e954d0feb0b566c81538ea6dad2edcffe16
- MD5 e40041e0ca436c712332edaa9db7df08
- SHA1 deb8ead922f4f1acbadebf0db998f6ba2dc53db0
- SHA512 1111be364c3d81dc919d1e7ba7bd141cda6555844d889f00a2b2cb0ee5c19bd0b122ae4b574a3cdfa268668eebec43fa265b44e1b8fa28faaa335824647b8bc2
- SSDEEP 6144:0uOQemROOMqMA8K3eEGOCUgtLD2J9dh4bYTJ6QKq:3O2OmMQGp2J9+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  ST6UNST.EXE
- Size 71KB
- SHA256 7e60c894a8cead6880fd3ed040504d02304a0b961304e40741340e31f5fa973d
- MD5 996f83e516552ca3b51445bb994a6d38
- SHA1 56fc6ba49195dedf735e6ce1b03ab36d72334f66
- SHA512 5868100fdb274dbad44ea0996aa4ed0a930cce5c61ce55631869bd19ee09feb8a957bf2a4a87ba563f48bb65807dae5b2363c042d451843e9598b10f6c334d2f
- SSDEEP 1536:hKTg6tZkYVxqdE5NLt3mZCSRCxDka6tg7N4G:IsixsE5b3mZCwC1AtgZ4G
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  VB6STKIT.DLL
- Size 99KB
- SHA256 df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b
- MD5 cff867572b44212b01b711c1fa009537
- SHA1 3978c9f7a3d77c0bdff4353949e2143757eebc79
- SHA512 1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4
- SSDEEP 3072:c6v5KkE3OEc4dUN5KgzIED1LAOWOa+dSogCh:csKkE+Ec4dU/KXEDunOaC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  asycfilt.dll
- Size 63KB
- SHA256 e701cb227daa19c9b91ecf9975a12351bc4d73454b894695a6c5f74f65b9b77a
- MD5 0bc326cd99125724987ceec7405496b6
- SHA1 cfd440400244c182fd064508e873d62529d285f3
- SHA512 efcad7817908ae1d503e7c1797e190b8b541cda62eb063aba4c96c0e7012803a3f2070cee597122974b84ad6c26c1c5508c57839df07a3fb140b817ef6fa7994
- SSDEEP 1536:3+N9Jz5cgH8fVTikHij8fdShRDGD5XlOB7RegH0zNKl7Q+:c9Jzsfc46hRDm5XgBTUzNKlk+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  msvbvm60.dll
- Size 1.3MB
- SHA256 fa75a67b0d6a8829993397c3a893c182641a8c4806bb1e46553dbad7f7aaf5d4
- MD5 e949eee7d1be07e32267fe10d9992c38
- SHA1 a4241fd4850a6e2fa36ef788a34283a23b85fbbb
- SHA512 22a789ff7fa41eb739c11a7a9e24f7db86b477650d0c89d937811ebb8a044093019c0728429c9880ee4d76d9bdcaa1d6dbd95ed7b623db619eba0f715586a35c
- SSDEEP 24576:Rc4BJ69cQtOv6iAPEF/HNBqXTG7UOB4JWE3tF+tGpzhkFGz8Jb6:RZX6HtOvOXTG7UNJWE3tFvzj4W
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  oleaut32.dll
- Size 540KB
- SHA256 4397d0fe3ef2cdb85dd811b8743c7700bd4e6d8d3365dcba5286aa10adb2c24a
- MD5 b3742dee858b243e77c73d2b8f7c8223
- SHA1 7a132127eb3efeca8f6bc3f20e49b5011b5ae5df
- SHA512 277f8f2750a562d5f8168c608928d232a3755662628bf7bb9ed17819786a0e7234534f5e028f4e1e0a2bec0468be5c12c56770c60713f06ac96422581fe26774
- SSDEEP 12288:DtppNnzQAuSIeoGuodbAR/Cv7MVDGKVAE0wKKae2M0TK:DnpxzQAWe9/dbq/Cv7MVpWwKKaY0TK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  olepro32.dll
- Size 81KB
- SHA256 54d7ee1e4b43d2590b3b9b4a412717bfecfcce46f9dda68dba4695f135faa7b5
- MD5 b48d3193dd1474dcbcc32bf4779ac698
- SHA1 4a39d43aea0766c159a32c311c9eb2e06dbf8c03
- SHA512 fdb0691dfb26d43708f8f12f6b75e2097570ba27a0040e0f8ecac30ef9307dedcf425cbec671a0178916675503542a7fa670fb5515ec231509d5aabd0047debb
- SSDEEP 1536:nIjsab9WEkUEAzs11+/nnJZL7aWsuN4kQfWNtMNwTs:Ij99WXmsbUnnL7Sy4kwWTts
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  stdole2.tlb
- Size 17KB
- SHA256 e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426
- MD5 0857394e30de11ca0cd9497e310d6469
- SHA1 ba35fba3e44040e7b891fa814dceff94d1c1b114
- SHA512 05309e02b7c427f379f3235d2d7398d53ee35b3f1f9d7f28ad72607c82e0af6163a2def42734666f7e1fd0b67395031632aff9c9af36fb30c0175fad145f1185
- SSDEEP 192:pMrSEiGPWF0Y3wAQgiQJdDg5rDLWQrNBm5C7BTNcJL8Bz8QFWocqGWcp:pM/uFrR+X6QNn1pcJI5WocqGWcp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  tora.exe
- Size 1.1MB
- SHA256 9a6e4f75fb820d8bf63d770a9c79f4717d1fc48ffba76940fc4dafa2320881fe
- MD5 2346349fc8e8e6db23c35fb0f87f6bf5
- SHA1 3622e640ea66838282ef9b56596452fbb3e3e20e
- SHA512 1cf5739e153d13c0a916adafad4e1fe282094eb4688bd194c0453c13a04c0a3e6c8b044650c3d0695a98fb077209ea9c391cedeecc2be43ab542485cc1684078
- SSDEEP 24576:tq1PSCgmkTUFb1XZDa7rRirAVKZhxvzAw8CXZ4VRRDixAAnlmr:8gmeUb1XZyrcUV41eRuyp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral27 behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28