General

  • Target

    mtc-artillery-overlay_0.2.6_x64-setup.exe

  • Size

    2.0MB

  • Sample

    241031-myyn1avnht

  • MD5

    dc4c7cb0d9d253262fced464a6a08616

  • SHA1

    8e78328687c0938059c0cef85213104b4346e8c9

  • SHA256

    bf95da373388b59f65687da8630866ab0de327c9ebc9487d5085477ac9e5275a

  • SHA512

    c364137e0a77152940024b736a3b98dcfc3c96e402e49ca892b80133e4d6db6bb244a7b83dad495e61204ceeebee368d3a4d9eea14feb17c93beffe3395cb167

  • SSDEEP

    49152:htqF/6lRZ7uz71flsaht0IlJNkdSF5bWTnUqtcNIu3wNDYGrbF:hEa7uzIs0eJNLHEtcNIaKDYGnF

Malware Config

Targets

    • Target

      mtc-artillery-overlay_0.2.6_x64-setup.exe

    • Size

      2.0MB

    • MD5

      dc4c7cb0d9d253262fced464a6a08616

    • SHA1

      8e78328687c0938059c0cef85213104b4346e8c9

    • SHA256

      bf95da373388b59f65687da8630866ab0de327c9ebc9487d5085477ac9e5275a

    • SHA512

      c364137e0a77152940024b736a3b98dcfc3c96e402e49ca892b80133e4d6db6bb244a7b83dad495e61204ceeebee368d3a4d9eea14feb17c93beffe3395cb167

    • SSDEEP

      49152:htqF/6lRZ7uz71flsaht0IlJNkdSF5bWTnUqtcNIu3wNDYGrbF:hEa7uzIs0eJNLHEtcNIaKDYGnF

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      15KB

    • MD5

      ee68463fed225c5c98d800bdbd205598

    • SHA1

      306364af624de3028e2078c4d8c234fa497bd723

    • SHA256

      419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

    • SHA512

      b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

    • SSDEEP

      384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij

    Score
    3/10
    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      d070f3275df715bf3708beff2c6c307d

    • SHA1

      93d3725801e07303e9727c4369e19fd139e69023

    • SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

    • SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • SSDEEP

      96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      25KB

    • MD5

      cbe40fd2b1ec96daedc65da172d90022

    • SHA1

      366c216220aa4329dff6c485fd0e9b0f4f0a7944

    • SHA256

      3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    • SHA512

      62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    • SSDEEP

      24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      6c3f8c94d0727894d706940a8a980543

    • SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    • SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    • SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    • SSDEEP

      96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

    Score
    3/10
    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      8def0196223484f8aed4106148dd3f08

    • SHA1

      e0fc0951deb0e5e741df10328f95c7d6678ad3aa

    • SHA256

      c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

    • SHA512

      9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

    • SSDEEP

      768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q

    Score
    3/10
    • Target

      mtc-artillery-overlay.exe

    • Size

      6.8MB

    • MD5

      0caef5fbd49129a76eba8ec8c4f11658

    • SHA1

      4e5a695e1b820fc3f4c9abd0eda420fb4e1c59be

    • SHA256

      6b61af33cbbaccd7002c6af299a56232be8e7bec0017ffd4bc9deeed71d8d672

    • SHA512

      2e58447dd635b6c912a516f69a6bc22f4a0541739a92df3703fe8a51b7457733bd0309ca626c7ae9e226a13bed575d396b0e3e2c8158fd6056cccb2a04d06d70

    • SSDEEP

      98304:+BkE93sBNGloK5vXr9MM4WfO0+rBq2zFug:skcsBkl1JMM9vqFZ

    Score
    1/10
    • Target

      uninstall.exe

    • Size

      74KB

    • MD5

      e47876c8d565e7fbbb236585607ef1ea

    • SHA1

      09ccb89aaa90b6bfa880cd7fbdda2c6bbb0e1c47

    • SHA256

      4d5e5238dfb95e961ff18714c62380b31962bd7c590d1982d0442425698867b9

    • SHA512

      48e035f35a22e348553ab221a12cfa6ade3fee6a357b6a8cf9fb26ad573637a96036fabaec40a84ede1b6fada669d1765c6a71ccad533a63b54dc31ce0af6ef8

    • SSDEEP

      1536:XmsAYBdTU9fEAIS2PEtuTgdLeAyNxE/9QnU3dr4EJxoHuh:WfY/TU9fE9PEtuTceAVjFxh

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      68b287f4067ba013e34a1339afdb1ea8

    • SHA1

      45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    • SHA256

      18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    • SHA512

      06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    • SSDEEP

      48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      8def0196223484f8aed4106148dd3f08

    • SHA1

      e0fc0951deb0e5e741df10328f95c7d6678ad3aa

    • SHA256

      c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

    • SHA512

      9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

    • SSDEEP

      768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoveryevasionpersistenceprivilege_escalationtrojan
Score
8/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

Score
3/10

behavioral10

Score
7/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

discovery
Score
7/10

behavioral18

discovery
Score
7/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10