Overview

overview

6

Static

static

3

rcsetup154.exe

windows7-x64

6

rcsetup154.exe

windows10-2004-x64

6

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$_107_/$_1...UI.dll

windows7-x64

3

$_107_/$_1...UI.dll

windows10-2004-x64

3

$_108_/lang-1025.dll

windows7-x64

1

$_108_/lang-1025.dll

windows10-2004-x64

1

$_108_/lang-1026.dll

windows7-x64

1

$_108_/lang-1026.dll

windows10-2004-x64

1

$_108_/lang-1027.dll

windows7-x64

1

$_108_/lang-1027.dll

windows10-2004-x64

1

$_108_/lang-1028.dll

windows7-x64

1

$_108_/lang-1028.dll

windows10-2004-x64

1

$_108_/lang-1029.dll

windows7-x64

1

$_108_/lang-1029.dll

windows10-2004-x64

1

$_108_/lang-1030.dll

windows7-x64

1

$_108_/lang-1030.dll

windows10-2004-x64

1

$_108_/lang-1031.dll

windows7-x64

1

$_108_/lang-1031.dll

windows10-2004-x64

1

$_108_/lang-1032.dll

windows7-x64

1

$_108_/lang-1032.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    rcsetup154.exe
  • Size 25.3MB
  • Sample241015-3slegstake
  • SHA256 dbf0895d886b428c8465ee57aea56a7e7b6e4c003efd04ca00d216a2d821eac9
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target
      rcsetup154.exe
    • Size 25.3MB
    • SHA256 dbf0895d886b428c8465ee57aea56a7e7b6e4c003efd04ca00d216a2d821eac9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitdiscoverypersistenceprivilege_escalationspywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/ButtonEvent.dll
    • Size 5KB
    • SHA256 e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 23KB
    • SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/g/gcapi_dll.dll
    • Size 348KB
    • SHA256 d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $_107_/$_107_/pfUI.dll
    • Size 18.2MB
    • SHA256 a639f28eb67410b9d685ff7eb564eb8c1a45f1116a6c520321510c8c6eb89923
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $_108_/lang-1025.dll
    • Size 44KB
    • SHA256 0dd80b0a75d09c587b54e4c527af5650ce0678d8dfb2627ff097439853b71a0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      $_108_/lang-1026.dll
    • Size 46KB
    • SHA256 10b7e73b445eb063300f8d5b76cc8b91e3de63ee4084c4766a7d68000a5a52e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      $_108_/lang-1027.dll
    • Size 51KB
    • SHA256 8156b27c1677ff3d5a0208aed2e01cec4d5e5b55e3390875329340d5f7972a27
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      $_108_/lang-1028.dll
    • Size 27KB
    • SHA256 16b27a8f4cf64a56cfdb8fe84ac497c8fbdaac3385bc0975ae63c39820f311d3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      $_108_/lang-1029.dll
    • Size 46KB
    • SHA256 bb648a873d5df48f1e2c3b7889c7ddbeddcfcc3d9ffdfdb5312a06e639fd7146
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      $_108_/lang-1030.dll
    • Size 46KB
    • SHA256 66be2616822511ddb956e352ed21beccfa5ae9299f5c925838161b26bba454ac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      $_108_/lang-1031.dll
    • Size 49KB
    • SHA256 e8c68e0bb516fd172c966c78fccb934fcc034e9b4cb909d3356b2f894ccf9177
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      $_108_/lang-1032.dll
    • Size 52KB
    • SHA256 21bb1f597d5e6ec2835eb9065a11e8bd39ca865102f4de20cb676fbb1a331ac0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistenceprivilege_escalationspywarestealer
Score
6/10

behavioral2

bootkitdiscoverypersistenceprivilege_escalationspywarestealer
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10