a8df7571e871d22f13ba3eb376eddd1f73ce241d24caa878494e1805219b342a

Resubmissions

20/01/2025, 14:20

250120-rnkrlstlal9

20/01/2025, 14:10

250120-rgp3rasren

20/01/2025, 07:44

250120-jkx9jaypay9

Sharing

Copy URL Twitter E-mail

General

Target
D0glun.exe
Size 2.5MB
Sample250120-rnkrlstlal
SHA256 a8df7571e871d22f13ba3eb376eddd1f73ce241d24caa878494e1805219b342a
MD5 845cb027c57783112416a2a32dc87f58
SHA1 44b0add34a5d97cbac2c3a4bc664027af7351ea4
SHA512 19e3e186d0454c36f2cd800fb6650ef5fe7336634b302e6fca21de5d42d5338c05bd5a3f16d1ee5add844ee73328f5df0dd419ff74f1c7369cfa2eb5cece82e1
SSDEEP 49152:vMjUZzwLYglZHVhxUdLaaCp/f+OSeUEb5QuPtp1Yu:UjUZaldVhxUdLa3Vf+OSed5QuPvN
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  D0glun.exe
- Size 2.5MB
- SHA256 a8df7571e871d22f13ba3eb376eddd1f73ce241d24caa878494e1805219b342a
- MD5 845cb027c57783112416a2a32dc87f58
- SHA1 44b0add34a5d97cbac2c3a4bc664027af7351ea4
- SHA512 19e3e186d0454c36f2cd800fb6650ef5fe7336634b302e6fca21de5d42d5338c05bd5a3f16d1ee5add844ee73328f5df0dd419ff74f1c7369cfa2eb5cece82e1
- SSDEEP 49152:vMjUZzwLYglZHVhxUdLaaCp/f+OSeUEb5QuPtp1Yu:UjUZaldVhxUdLa3Vf+OSed5QuPvN
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (1012) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Renames multiple (1012) files with added filename extension

Disables Task Manager via registry modification

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2