Overview

overview

7

Static

static

1

DOpusInstall.exe

windows7-x64

4

DOpusInstall.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOpusInstall.exe

  • Size

    38.5MB

  • Sample

    241101-vlxj6s1pbv

  • MD5

    99540b8e8d91ae5546fc24410a96c457

  • SHA1

    f36a5a85c041126a48d7486420bf35da8c31d922

  • SHA256

    4d385b9fde266f9685f95949c60ec9f5b29d1bde22de2eb0c882bca8eac71293

  • SHA512

    4400f7bb0a2e78c729228149cd8d47ea55c9b5f3207fc95478c4e31316c42423c4bbf7eece178b316a9153230bc0ac87873ba203d01ff39eb348fdf72b7d14a5

  • SSDEEP

    786432:/kHdKBCtY9GML0dko3ad91eoUJ9gARHTVw6Z1Wq+NYr79b7GE2xlDRB:+g99GM4v3ad99AhRHTVfZ1Wq+0ExN

Score
7/10
discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target

      DOpusInstall.exe

    • Size

      38.5MB

    • MD5

      99540b8e8d91ae5546fc24410a96c457

    • SHA1

      f36a5a85c041126a48d7486420bf35da8c31d922

    • SHA256

      4d385b9fde266f9685f95949c60ec9f5b29d1bde22de2eb0c882bca8eac71293

    • SHA512

      4400f7bb0a2e78c729228149cd8d47ea55c9b5f3207fc95478c4e31316c42423c4bbf7eece178b316a9153230bc0ac87873ba203d01ff39eb348fdf72b7d14a5

    • SSDEEP

      786432:/kHdKBCtY9GML0dko3ad91eoUJ9gARHTVw6Z1Wq+NYr79b7GE2xlDRB:+g99GM4v3ad99AhRHTVfZ1Wq+0ExN

    Score
    7/10
    discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks