Overview

overview

7

Static

static

3

ccsetup629.exe

windows7-x64

6

ccsetup629.exe

windows10-2004-x64

7

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$_134_/lang-1025.dll

windows7-x64

1

$_134_/lang-1025.dll

windows10-2004-x64

1

$_134_/lang-1026.dll

windows7-x64

1

$_134_/lang-1026.dll

windows10-2004-x64

1

$_134_/lang-1027.dll

windows7-x64

1

$_134_/lang-1027.dll

windows10-2004-x64

1

$_134_/lang-1028.dll

windows7-x64

1

$_134_/lang-1028.dll

windows10-2004-x64

1

$_134_/lang-1029.dll

windows7-x64

1

$_134_/lang-1029.dll

windows10-2004-x64

1

$_134_/lang-1030.dll

windows7-x64

1

$_134_/lang-1030.dll

windows10-2004-x64

1

$_134_/lang-1031.dll

windows7-x64

1

$_134_/lang-1031.dll

windows10-2004-x64

1

$_134_/lang-1032.dll

windows7-x64

1

$_134_/lang-1032.dll

windows10-2004-x64

1

$_134_/lang-1034.dll

windows7-x64

1

$_134_/lang-1034.dll

windows10-2004-x64

1

$_134_/lang-1035.dll

windows7-x64

1

$_134_/lang-1035.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ccsetup629.exe
  • Size 73.6MB
  • Sample241111-2yp47asjgr
  • SHA256 4eb8b3718c8160544e064f06672aac6deb584bc2197bd5dc72dd8f6056b665b1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoverypersistencephishingspywarestealer

Malware Config

Targets

    • Target
      ccsetup629.exe
    • Size 73.6MB
    • SHA256 4eb8b3718c8160544e064f06672aac6deb584bc2197bd5dc72dd8f6056b665b1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoverypersistencespywarestealerphishing

    • A potential corporate email address has been identified in the URL: 67C716D751E567F70A490D4C@AdobeOrg

      phishing

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 23KB
    • SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $_134_/lang-1025.dll
    • Size 251KB
    • SHA256 363def9535136e7723a30919856e93ce9c9cfc73474f0f93ec9fb1aa9c9e7228
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      $_134_/lang-1026.dll
    • Size 299KB
    • SHA256 438d554b8df2fbad630063cca763fbe14d2864880eb2e1ed62211dc9c7f94256
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      $_134_/lang-1027.dll
    • Size 301KB
    • SHA256 f7b5c7d2b41c3ded8686edd613306045ec8651a1916b94184e58bc5ce513d3d7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      $_134_/lang-1028.dll
    • Size 117KB
    • SHA256 427579b55a9d2be576d2df71907b3681c30010cc807b8b4f6eefede3eb309d9a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      $_134_/lang-1029.dll
    • Size 265KB
    • SHA256 0378945d2e3f6a290c6b3d637f5c8a068900e74fedf11d41d4210e04998c52f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      $_134_/lang-1030.dll
    • Size 262KB
    • SHA256 b091fc2d4e0824ce7be34d6220c14debeb62dbba419da99c031c2e4ec5adaa69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      $_134_/lang-1031.dll
    • Size 296KB
    • SHA256 b4a93e8b8d6bfcc4658ecf1dab82d4c2e070f60c31b2da121e88744ffdc78a33
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      $_134_/lang-1032.dll
    • Size 309KB
    • SHA256 46bd15ec07fb1cc9d9507b4aa5a3f313ff30b09a6b46459c8378f60f03ce4f8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      $_134_/lang-1034.dll
    • Size 295KB
    • SHA256 32cfb7c94dc992eae1732ad3b11e567faf4a6e88101fc597ec105ed8e4e60397
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      $_134_/lang-1035.dll
    • Size 273KB
    • SHA256 7206856f430fc75f2cc1a06f243db0f87c12c6aa0b51447aa421791ed8a4ffc7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

bootkitdiscoverypersistencespywarestealer
Score
6/10

behavioral2

bootkitdiscoverypersistencephishingspywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10