e7682aa95ecad07c13ddff54ee90b53e2a126c75aa42aa5aabae5f5134dfa166 | Triage

Sharing

General

Target

4324432c547b9d272033e7b4483b0bb3.bin
Size

38.1MB
Sample

241124-blp1jssnbj
MD5

5afd3281df0c2257d43e0b450a6420ae
SHA1

15221ceeceddbda2d0ad91298f03aabcb479aa23
SHA256

e7682aa95ecad07c13ddff54ee90b53e2a126c75aa42aa5aabae5f5134dfa166
SHA512

8bd1b5c4b214c5e0572eed3fff2e9a93a367333de02eaeb7b0047114a205b7f020806fd690c85727c23f63534f94b7846989c7a6a6e753a5a8bd80e2b240ceb8
SSDEEP

786432:Lw9jREI8jLu0SWQqvvkY1yxB4BZQQ++TmhZduwjSh0x:LCjREIyLu0rQ3YAxB4BL+vfS2x

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  AbRoot.dll
- Size
  
  355KB
- MD5
  
  530957a391c6bc978ae7179179594b12
- SHA1
  
  f174b1575ebc2f6612272cf39215d5dc27ee6b38
- SHA256
  
  9fbeab4bcfcec34dc13cad90609101b2ea099069ab173555635f174597e4ea09
- SHA512
  
  9f3da37b8b8047bcc463c2d12360c6bc99bf35868a14222abb2108e103bab5355d1c069d5ac775bd3c7c953a9c8c3299bd61287c4fb7a074f36a4450e95368e2
- SSDEEP
  
  3072:mB16MsQd1V0rSJkRd2Ygeu1qs93J2FooJafVMkZuP9Dy4s5zTG22+xF0KA6ppDwZ:mBXT1V0WojDy4s5MQV0jw0
Score

1^/10
behavioral1 behavioral2
- Target
  
  AdTree.dll
- Size
  
  355KB
- MD5
  
  530957a391c6bc978ae7179179594b12
- SHA1
  
  f174b1575ebc2f6612272cf39215d5dc27ee6b38
- SHA256
  
  9fbeab4bcfcec34dc13cad90609101b2ea099069ab173555635f174597e4ea09
- SHA512
  
  9f3da37b8b8047bcc463c2d12360c6bc99bf35868a14222abb2108e103bab5355d1c069d5ac775bd3c7c953a9c8c3299bd61287c4fb7a074f36a4450e95368e2
- SSDEEP
  
  3072:mB16MsQd1V0rSJkRd2Ygeu1qs93J2FooJafVMkZuP9Dy4s5zTG22+xF0KA6ppDwZ:mBXT1V0WojDy4s5MQV0jw0
Score

1^/10
behavioral3 behavioral4
- Target
  
  QtCore4.dll
- Size
  
  2.5MB
- MD5
  
  fecc62a37d37d9759e6b02041728aa23
- SHA1
  
  0c5f646caef7a6e9073d58ed698f6cfbfb2883a3
- SHA256
  
  94c1395153d7758900979351e633ab68d22ae9b306ef8e253b712a1aab54c805
- SHA512
  
  698f90f1248dacbd4bdc49045a4e80972783d9dcec120d187abd08f5ef03224b511f7870320938b7e8be049c243ffb1c450c847429434ef2e2c09288cb9286a6
- SSDEEP
  
  49152:VTFgiFpGXOENKSgjGkJsv6tWKFdu9C6TELyvL/6mShMZtmjNUVrciV5P+7QVg07/:V+iDaWjxJsv6tWKFdu9CZgfQ
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  QtGui4.dll
- Size
  
  8.2MB
- MD5
  
  831ba3a8c9d9916bdf82e07a3e8338cc
- SHA1
  
  6c89fd258937427d14d5042736fdfccd0049f042
- SHA256
  
  d2c8c8b6cc783e4c00a5ef3365457d776dfc1205a346b676915e39d434f5a52d
- SHA512
  
  beda57851e0e3781ece1d0ee53a3f86c52ba99cb045943227b6c8fc1848a452269f2768bf4c661e27ddfbe436df82cfd1de54706d814f81797a13fefec4602c5
- SSDEEP
  
  98304:YxRJATZlLne1/cF6ZWHxD1HFH+J+70msIWeiLtRgi3d4PJpTcSqxyr:YxiZBG2xpljTcJy
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  QtNetwork4.dll
- Size
  
  1.0MB
- MD5
  
  8a2e025fd3ddd56c8e4f63416e46e2ec
- SHA1
  
  5f58feb11e84aa41d5548f5a30fc758221e9dd64
- SHA256
  
  52ae07d1d6a467283055a3512d655b6a43a42767024e57279784701206d97003
- SHA512
  
  8e3a449163e775dc000e9674bca81ffabc7fecd9278da5a40659620cfc9cc07f50cc29341e74176fe10717b2a12ea3d5148d1ffc906bc809b1cd5c8c59de7ba1
- SSDEEP
  
  12288:m+PpRNPe4+DZFvnwJ9o+Hllp59K03AskvvukLosiLHrv7F0YmIYunuGS:m+hRCZhwY+Hllp59OHvfo7HrCYmItnC
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  QtXml4.dll
- Size
  
  348KB
- MD5
  
  e9a9411d6f4c71095c996a406c56129d
- SHA1
  
  80b6eefc488a1bf983919b440a83d3c02f0319dd
- SHA256
  
  c9b2a31bfe75d1b25efcc44e1df773ab62d6d5c85ec5d0bc2dfe64129f8eab5e
- SHA512
  
  93bb3dd16de56e8bed5ac8da125681391c4e22f4941c538819ad4849913041f2e9bb807eb5570ee13da167cfecd7a08d16ad133c244eb6d25f596073626ce8a2
- SSDEEP
  
  6144:6gdDO1NTI8ew+Rh9CY8gjvXQ0AObEL9gqIL:6gda1FI8V+f9FFzA1IL
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Set-up.exe
- Size
  
  6.2MB
- MD5
  
  11c8962675b6d535c018a63be0821e4c
- SHA1
  
  a150fa871e10919a1d626ffe37b1a400142f452b
- SHA256
  
  421e36788bfcb4433178c657d49aa711446b3a783f7697a4d7d402a503c1f273
- SHA512
  
  3973c23fc652e82f2415ff81f2756b55e46c6807cc4a8c37e5e31009cec45ab47c5d4228c03b5e3a972cacd6547cf0d3273965f263b1b2d608af89f5be6e459a
- SSDEEP
  
  98304:u4bRxuHuFP2rHLpHPA477yNRgoPbfnRROWR721LYfs17u0kcFrXLEJfwY:u4NxuOFI1AEyrbf/52BYfs1LkcFrXL+X
Score

6^/10

discovery
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral13 behavioral14
- Target
  
  StarBurn.dll
- Size
  
  648KB
- MD5
  
  bbf0b66f271322a7c5701d5488d6a6dd
- SHA1
  
  d4978e0cfcb374066bdaefea2aacf0417830ed95
- SHA256
  
  39f8082f72067be64270647f899919582438a0c7461c439174767b139406abd8
- SHA512
  
  a98c6bbb312ecb1ba30dacb39c755de7f48ee105bb014f51f3096b225ef6a0f73258d7f142965ec94a8f4dbf8da4d0cef4e6e3b85d17201236fa7a02555cb532
- SSDEEP
  
  12288://gzbnbASodCXNn5FJX5KpN9VmoBBDFxna:HRSoSn5FJX5KP9VmoDW
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  msvcp100.dll
- Size
  
  411KB
- MD5
  
  03e9314004f504a14a61c3d364b62f66
- SHA1
  
  0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d
- SHA256
  
  a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
- SHA512
  
  2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d
- SSDEEP
  
  12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  msvcr100.dll
- Size
  
  752KB
- MD5
  
  67ec459e42d3081dd8fd34356f7cafc1
- SHA1
  
  1738050616169d5b17b5adac3ff0370b8c642734
- SHA256
  
  1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
- SHA512
  
  9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
- SSDEEP
  
  12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  opengl64.dll
- Size
  
  17.7MB
- MD5
  
  0a84667145e7efef026c888d4b768126
- SHA1
  
  27673e1bd7c55bba6eaa37620d3b3820ce45d46a
- SHA256
  
  dd575f3c64382193610815909bd2c52490244ecbbb9bba6eef5fe4f0bb43bb4d
- SHA512
  
  3e964c996ed358787c4dfdb965a00b38b4118c804ae1bf8d32aeb7d936584e72c188e3fa0d27d1c2ffd3be13dca8045b08b28b15070812c195d82d1bf23a2604
- SSDEEP
  
  393216:PXhbUNnoBP98OQ//aXUszfTBHCOUZ2UenCDkOH2:PXhNB4nlW
Score

1^/10
behavioral21 behavioral22
- Target
  
  updater/nvdisps.dll
- Size
  
  11.1MB
- MD5
  
  da3e5ecda1487fdbcc6d7db314815696
- SHA1
  
  b2775d5a94a2af489590e1544dbff7176c39d389
- SHA256
  
  77173b4b61b59eca507ca3ece87a77a87e4e77a48dd162ba813d61cb0513421d
- SHA512
  
  cb3a14dbb15fad5bee97f3ec2236c7946778b1c884b38086026029f1bbbf20648e420bd829a82b8796f420ee50a5ef896bdc9aaccc67b82ac4e89eb67294c656
- SSDEEP
  
  98304:XNTNmlyn5aaKgwF2MxtrjgEe2eVivataUN3Dumf/S+CJ4RoLERm6iVv/lraqXtxG:XNT8lxjVWiCwUN3d/RbCv/9tx/KLce3
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23 behavioral24
- Target
  
  updater/nvdispsr.dll
- Size
  
  11.0MB
- MD5
  
  d74d7dca89d97bc912a376a5c34172b1
- SHA1
  
  6420073ab703884dbacd499c1b7174f858e2068c
- SHA256
  
  0681d4e92b84d238b3e3fb118b0a359be1aba83528b94f7fde2d9101d8163417
- SHA512
  
  3e4a308794b05b9eb99902367ed8916a590316261175b02dd35007fabd900d715625e48aa0d5b5518f02550b0b678eb7ef83dc96f68632d93d21378351d82f2c
- SSDEEP
  
  98304:0lRaeidue2eFivataUN3Demf/S+CJ4RoLEROyiev/lraqXtx/SzLce3hNc:+CliCwUN3d/Rb5v/9tx/KLce3hNc
Score

1^/10
behavioral25 behavioral26
- Target
  
  updater/nvptxJitCompiler32.dll
- Size
  
  16.6MB
- MD5
  
  3ea5205d6831ddc3670ab8eeacb853f5
- SHA1
  
  dadb303e031089535ea01c8a10d89c1033a5d7a4
- SHA256
  
  caa6ae6c505e54875761443171c229ed367b2e51e448a9034b81be062b961847
- SHA512
  
  5e7118d3db968d30f7020fb5a3e4373acd1572eb7736f55229d1aba836e43b755cff2d78e7bd22daebec5a53bbcf7eaf00a0a5d233bc6679c36675a03bc1b36b
- SSDEEP
  
  196608:LeXcR+Vei+lHBfL90NUIE4/pp1D84she84lt7Hpml9DCqIsXC:Q5+7j9SG4lw4HDltLknc
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  x64/trading_api64.dll
- Size
  
  282KB
- MD5
  
  2bca4e2c047ec969cb3cff277e7fc184
- SHA1
  
  c4b5b00b605e59c6fdcb6731f2e53069506e287a
- SHA256
  
  f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
- SHA512
  
  3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
- SSDEEP
  
  6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x
Score

1^/10
behavioral29 behavioral30
- Target
  
  x64/tradingnetworkingsockets.dll
- Size
  
  4.1MB
- MD5
  
  3cf26ce759c5e261fe3ecc6451b8b08e
- SHA1
  
  b5da110034fe394a4020367404534903764473fe
- SHA256
  
  fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
- SHA512
  
  e7b543483f38bb6338490b5c8f5da6f95e0d78b45f2b26d898cc3b58cf7c359952bfe413414cb6cd1532c3c6fd7a860026b2bec7b6d0ddfbee9a1385a62e14f2
- SSDEEP
  
  49152:kGtlqhcIU6ilVwASObX9F+LWDumqrJjAZVT4kmrqEUAYVxkG3q+XRQsmqkALD4z4:M+dl7+8z1mqkA8lv0bH1bBGZZs
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

persistenceprivilege_escalation

behavioral24

persistenceprivilege_escalation

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32