Overview

overview

8

Static

static

3

7zxa.dll

windows7-x64

3

7zxa.dll

windows10-2004-x64

3

CSRPS.dll

windows7-x64

1

CSRPS.dll

windows10-2004-x64

1

CSRPS.exe

windows7-x64

8

CSRPS.exe

windows10-2004-x64

8

unrar.dll

windows7-x64

3

unrar.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65ewe.zip

  • Size

    37.4MB

  • Sample

    241101-vfqvfatbrj

  • MD5

    612f55abe38fde2136df8e3a56a2d90d

  • SHA1

    0b014e42631de33c2fa12c078338dec382ec8461

  • SHA256

    f8f04c79d0c8d1bb0fdf960974e20f8fedcdc1ae08a7abad607e8939832b8af1

  • SHA512

    806b95c11aff4c213a351dcf3bef385de4efcae497c3aeafadcd7b63db60c9eea8914c435af0509777efc7df15342d4e485b840912e397dbcaa34f42cc79856d

  • SSDEEP

    786432:h0hpRR730kCsQ2YbYaoEHeJ+v6L6FiS2+wHAi1RoS9pVivXMaj0l+OV2FT1tJzh:h0hpRR73hS2YcanFif+wDzELl51tJzh

Score
8/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      7zxa.dll

    • Size

      73.9MB

    • MD5

      af7d22738c42105a329096b9179aef09

    • SHA1

      a347b001bc38683f3a799e0c4d808440019e864b

    • SHA256

      028aaedada137d029f392ed5eeda05498cfb670f770d11ab0e99d78190c476d7

    • SHA512

      5a6afff9b8d0bff3885ec62a9fa625902532185a5f1d8e056030520d797bd0cb65eef8f4c38b280f71341ba39557a6ac6747a1e3ea247fea05f2780d3c58c43e

    • SSDEEP

      393216:d9VDTLOgTmK2yafcQeJEAKQ19CftILyEwR6dTOnJIa5yJBz7h8zxPtYLx5mYfAHb:SK2RfxBr2sEewOJIaIp8zxtYd5mYfc

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      CSRPS.dll

    • Size

      415KB

    • MD5

      dac35720be4d4105234c4c99208c43d9

    • SHA1

      ca13aec5182035ac053004d51ddf4ec9a018b494

    • SHA256

      dadf7277164ac0d065fead44b1ed3e3fd9bccca39315ab35def952036a0b0b80

    • SHA512

      e4fff267040503457de828fafaf73c7a1c095ff87e85bd6cc9d1991193a8a1e51faef1ddf9ea5400849a6aaba9793dd9ffa68e032a293acd134f3274d05aa525

    • SSDEEP

      12288:UtoqntFyEUT4agzv5asqKIBqbGoLJV3Tvl8M8CIh5:UtoctFrUTVg9asqKgOxJV3T6DCU5

    Score
    1/10
    behavioral3behavioral4

    • Target

      CSRPS.exe

    • Size

      9.1MB

    • MD5

      74d3f521a38b23cd25ed61e4f8d99f16

    • SHA1

      c4cd0e519aeca41e94665f2c5ea60a322deb3680

    • SHA256

      1d822b3faabb8f65fc30076d32a95757a2c369ccb64ae54572e9f562280ae845

    • SHA512

      ec1c8b0eb895fd8947cad6126abc5bca3a712e42475228b9dcb3496098e720abb83d4cba4621edbd8d3ad7f306a5f57ced9c2c98fe2c2d0c8ebbbf99d7faf0f1

    • SSDEEP

      196608:bmFQso3Id5AypjCIN325pMKhQaLh6sOo5LZvqy1f:OQseId5AyZIpMKVLhJtJqS

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral5behavioral6

    • Target

      unrar.dll

    • Size

      174KB

    • MD5

      4289541be75e95bcfff04857f7144d87

    • SHA1

      5ec8085e30d75ec18b8b1e193b3d5aa1648b0d2e

    • SHA256

      2631fcdf920610557736549e27939b9c760743a2cddec0b2c2254cfa40003fb0

    • SHA512

      3137a7790de74a6413aca6c80fd57288bcc30a7df3a416f3c6e8666041cd47a9609136c91405eee23224c4ae67c9aebbba4dd9c4e5786b09b83318755b4a55fd

    • SSDEEP

      3072:4Jb18kAn0/QVt5ch1fIBNXaQpZj1JtmosqpdFBVhz3s5xqW3W5/9rSgvWFI:g58kA0/QVPch1QXK6HmosyBhY62Y9Lee

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks