General
-
Target
AtomrineSetup.exe
-
Size
164KB
-
Sample
241116-stlfrsyfln
-
MD5
7b5754dc88359e3475a9f6e42ec274d4
-
SHA1
c6e7cb61216cba1de7e5b83eeaf20725435561fd
-
SHA256
c144fb682278c5dae6d4daafa49b0c63d6181e4b26055abaa676b267ca18890b
-
SHA512
f8ed64a36795f1faaaa2771dbf40302a07c02794f7c7a2b7a9e228dcb135de0f22700ce2d228269b456b73b194a69b82170d0d095fcfc0bf60d38b4b2ea3e637
-
SSDEEP
3072:qahKyd2n31d5GWp1icKAArDZz4N9GhbkrNEkO9gk:qahOxp0yN90QEH
Static task
static1
Behavioral task
behavioral1
Sample
AtomrineSetup.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
AtomrineSetup.exe
-
Size
164KB
-
MD5
7b5754dc88359e3475a9f6e42ec274d4
-
SHA1
c6e7cb61216cba1de7e5b83eeaf20725435561fd
-
SHA256
c144fb682278c5dae6d4daafa49b0c63d6181e4b26055abaa676b267ca18890b
-
SHA512
f8ed64a36795f1faaaa2771dbf40302a07c02794f7c7a2b7a9e228dcb135de0f22700ce2d228269b456b73b194a69b82170d0d095fcfc0bf60d38b4b2ea3e637
-
SSDEEP
3072:qahKyd2n31d5GWp1icKAArDZz4N9GhbkrNEkO9gk:qahOxp0yN90QEH
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1