Overview
overview
10Static
static
3NoRiskClie...up.exe
windows11-21h2-x64
10$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$TEMP/Micr...up.exe
windows11-21h2-x64
6NoRiskClient.exe
windows11-21h2-x64
6uninstall.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3General
-
Target
NoRiskClient-Windows-setup.exe
-
Size
8.7MB
-
Sample
241121-ypkxbszqdl
-
MD5
60071b5988925bbc1efed1f7296826d3
-
SHA1
ca7c61b5be8fe4ab9e1b3c6af4f646767044bebf
-
SHA256
fe4f6adeb25337cf07aa3de20543a6505923f721d7ccdab5c83369115a3bc734
-
SHA512
1a52ea41c2636efc2b7ec8727222e52c57715a907b28f7a5262ad0a4a8ee7599c7cb31b70eaa2d5c85a3ca8112ac0bb556d09d4115e6a3fcf1d56566e43cf8ca
-
SSDEEP
196608:htU+XCd9Hw7Jc5RT+Z4LVYA9e+FW86GSHAGnxrPDOCfg:httXCdXB64pW+FI3rxf7g
Static task
static1
Behavioral task
behavioral1
Sample
NoRiskClient-Windows-setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
NoRiskClient.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
uninstall.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
NoRiskClient-Windows-setup.exe
-
Size
8.7MB
-
MD5
60071b5988925bbc1efed1f7296826d3
-
SHA1
ca7c61b5be8fe4ab9e1b3c6af4f646767044bebf
-
SHA256
fe4f6adeb25337cf07aa3de20543a6505923f721d7ccdab5c83369115a3bc734
-
SHA512
1a52ea41c2636efc2b7ec8727222e52c57715a907b28f7a5262ad0a4a8ee7599c7cb31b70eaa2d5c85a3ca8112ac0bb556d09d4115e6a3fcf1d56566e43cf8ca
-
SSDEEP
196608:htU+XCd9Hw7Jc5RT+Z4LVYA9e+FW86GSHAGnxrPDOCfg:httXCdXB64pW+FI3rxf7g
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
d070f3275df715bf3708beff2c6c307d
-
SHA1
93d3725801e07303e9727c4369e19fd139e69023
-
SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
-
SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
-
SSDEEP
96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
6c3f8c94d0727894d706940a8a980543
-
SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd
-
SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
-
SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
SSDEEP
96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score3/10 -
-
-
Target
$PLUGINSDIR/nsis_tauri_utils.dll
-
Size
29KB
-
MD5
c5bd51b72a0de24a183585da36a160c7
-
SHA1
f99a50209a345185a84d34d0e5f66d04c75ff52f
-
SHA256
5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
-
SHA512
1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
-
SSDEEP
768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
Score3/10 -
-
-
Target
$TEMP/MicrosoftEdgeWebview2Setup.exe
-
Size
1.6MB
-
MD5
431a51d6443439e7c3063c36e18e87d6
-
SHA1
5d704eb554c78f13b7a07c90e14d65f74b590e3a
-
SHA256
726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6
-
SHA512
495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd
-
SSDEEP
49152:9iEf3nHwPrSzBVf0mtw+gGTU3YRzA1izx18nMlb:9iOG2zBJ0c9RE102nYb
Score6/10-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
-
-
Target
NoRiskClient.exe
-
Size
24.5MB
-
MD5
493cc97dab515a4f4c0ec3de28edc191
-
SHA1
1423ca4417213c38f373b8804969e5e84dda7803
-
SHA256
22e5519312a3983d0b95b6b6a3f4cc6de6c8777731895020ad647702db7267b8
-
SHA512
14f50834df4220d1d798fda59b35d4cf14c12e6a6c453ebafa17480cdaf3c4f87ed4de2dc9d8fb059bb4ab2fa3b35622b6308f77179babc32bc5445e462d9a6d
-
SSDEEP
196608:Dg5hJMkGleyj5hVtMGOweJt8QitNFJqaaXbnFKNFQ:qhJBGlJdt9tQitxqaaXbFEFQ
Score6/10 -
-
-
Target
uninstall.exe
-
Size
74KB
-
MD5
e4f83436a1831d549784302c2cbb1374
-
SHA1
110c4def245b6cb0949eb26690fec090b0c02793
-
SHA256
e96b87b2e9207ff76755ead324c9b87189a06a59edceaf7dd04e6e58e9788fd4
-
SHA512
2cf29b63bda0a7fbb71a348dc20d0b941129efca60ad54d4334dcc080c5b9f55ed192ce1b729d5e23f91e1224570e3c0afda9fc655a3d84e3326d71ead053737
-
SSDEEP
1536:XmsAYBdTU9fEAIS2PEtuSgdLeAyNxWYyQ4n8RV3t/L6s6:WfY/TU9fE9PEtuSceAf2++3t/LT6
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
68b287f4067ba013e34a1339afdb1ea8
-
SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3
-
SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
-
SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
SSDEEP
48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -
-
-
Target
$PLUGINSDIR/nsis_tauri_utils.dll
-
Size
29KB
-
MD5
c5bd51b72a0de24a183585da36a160c7
-
SHA1
f99a50209a345185a84d34d0e5f66d04c75ff52f
-
SHA256
5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
-
SHA512
1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
-
SSDEEP
768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
Score3/10 -
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1