Extracted

Extracted

• • Target

    RNSM00422.7z

  • Size

    15.8MB

  • MD5

    89d6c2eb7075a803f32f961cd0a84fa6

  • SHA1

    fe2b68e4cebd253682638996261d02c8337a7a46

  • SHA256

    351e791501d38c3670ea34996879efd92c921df3296077dd25d972b4790e4e5f

  • SHA512

    260f1346264064fc4b0ba25594c184c93017c47b7af6135d726e0c560d1d90e6395bc02ec7da6d90497562ddeac52d0efa8ef05fb5d67af98732d51270e347ec

  • SSDEEP

    393216:L+XTElA+HgPV6LWfLsTgFJ7YCqmCllCVT+TwKz+OQN1ZHA:K4VHwV7LRKLEkK7Zg

  Score

  10^/10

  agentteslahellokittymodiloaderxmrigdefense_evasiondiscoveryevasionexecutionimpactkeyloggerminerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • HelloKitty Ransomware

    Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.

    ransomwarehellokitty

  • Hellokitty family

    hellokitty

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • AgentTesla payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • ModiLoader Second Stage

  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • XMRig Miner payload

    miner

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hijack Execution Flow: Executable Installer File Permissions Weakness

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1