Overview

overview

10

Static

static

3

ui_0.0.26_...up.exe

windows10-ltsc_2021-x64

10

ui_0.0.26_...up.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

ui.exe

windows11-21h2-x64

6

ui.exe

windows10-ltsc_2021-x64

6

uninstall.exe

windows11-21h2-x64

7

uninstall.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0.0.26.zip

  • Size

    6.0MB

  • Sample

    250404-cfehasxzcv

  • MD5

    538bca27d79f2214ec556569297fdc98

  • SHA1

    bc33c1179dccb1979c6a5fe3609b4cd0ffb5fab6

  • SHA256

    c60e8d31d641c7a37ff1e7c7d0b1bafdd5847495e6973b466356e40fe48154ee

  • SHA512

    968005932226079cbb15f9ce3cad691678e8386ca71797023e4d7110a2f44b022776a7384ff4c351230c9a55cff3a09163fbced34158c2a0670fd624f9d7a0ec

  • SSDEEP

    98304:WRL4iWaKZn3jYiZ71YDO+7v2GrWFZd8jHLZO8JUcEZ7ORxBIjMHlcuaLmyMGGuN4:WyHp3Z71Yq+72M2SLYa2kBIofhGFN2bD

Score
10/10
defense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      ui_0.0.26_x64-setup.exe

    • Size

      6.0MB

    • MD5

      257e0184c3b29f7acfa018b11d23cef1

    • SHA1

      4756b5466ab51b7a83a83cb0347a5fb24ee992b3

    • SHA256

      e3e6c7ac473c963276dc3c1e4595658aebc9ed4ba4585b6600dccbd5b82e3d49

    • SHA512

      f96c0259ea0ef194f0c7abc89797f60907395d9c85c0370e5ba8d79d5fda8954a88f30dd08ad62755034febe3741ddf5376a866eb969a4bcfdb5ecd33af8e248

    • SSDEEP

      98304:xRL4iWaKZn3jYiZ71YDO+7v2GrWFZd8jHLZO8JUcEZ7ORxBIjMHlcuaLmyMGGuNP:xyHp3Z71Yq+72M2SLYa2kBIofhGFN2bm

    Score
    10/10
    defense_evasiondiscoverytrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      15KB

    • MD5

      ee68463fed225c5c98d800bdbd205598

    • SHA1

      306364af624de3028e2078c4d8c234fa497bd723

    • SHA256

      419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

    • SHA512

      b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

    • SSDEEP

      384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      d070f3275df715bf3708beff2c6c307d

    • SHA1

      93d3725801e07303e9727c4369e19fd139e69023

    • SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

    • SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • SSDEEP

      96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      6c3f8c94d0727894d706940a8a980543

    • SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    • SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    • SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    • SSDEEP

      96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      c5bd51b72a0de24a183585da36a160c7

    • SHA1

      f99a50209a345185a84d34d0e5f66d04c75ff52f

    • SHA256

      5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266

    • SHA512

      1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc

    • SSDEEP

      768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      ui.exe

    • Size

      15.8MB

    • MD5

      7821f6e1ae3239e1f8250fd2e2b2272d

    • SHA1

      92d9aadd08d05b6c778b9f4ee628f315999b18e0

    • SHA256

      495fa56ca85a4e68837f4d2b0628e903a254540b8cef14caeeb7500137e747a1

    • SHA512

      4410fdd83d2ade40d9fd92d4b33a40c59b291f29fa7a2f4c0b1eb912261b10ecde541651bf7c83b41aed8b686e91aa5488ecfd8f2c23968167d02cf4abb6744d

    • SSDEEP

      98304:aPPbD4xnuPaRJRx74o09lHXnUhKRe7IZSMhpFyV7cxPrwqQ2jJ6cefe2vtjlprk/:aPWRt49TiKgwFK0VjJe99IXWNdU3

    Score
    6/10
    defense_evasiondiscoverytrojan
    behavioral13behavioral14

    • Target

      uninstall.exe

    • Size

      74KB

    • MD5

      a8ebde28c00aecf243e97355ef1e6ca4

    • SHA1

      9a4ab77f60b163f6cc77b9a3ea4da27e277ec665

    • SHA256

      aa816082c18ca3a93f87af2a61b2ad85041fedc8ead0439735c8bc0e1856e5ec

    • SHA512

      42b39e5df98ca4d944f2fbb03702c1f4007a007501f48c1121bfd1ff54728e6f6f21e23f73dbeeb7b103e7f38b2947863dd62f57c6da877cd2996f1983fc25af

    • SSDEEP

      1536:HmsAYBdTU9fEAIS2PEtuOgdLeAyNxhSlb28sUmhU2Ui0Rb:GfY/TU9fE9PEtuOceAUSl1XkUP

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral15behavioral16

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      68b287f4067ba013e34a1339afdb1ea8

    • SHA1

      45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    • SHA256

      18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    • SHA512

      06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    • SSDEEP

      48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      c5bd51b72a0de24a183585da36a160c7

    • SHA1

      f99a50209a345185a84d34d0e5f66d04c75ff52f

    • SHA256

      5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266

    • SHA512

      1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc

    • SSDEEP

      768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/

    Score
    3/10
    discovery
    behavioral21behavioral22

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoverytrojan
Score
10/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

defense_evasiondiscoverytrojan
Score
6/10

behavioral14

defense_evasiondiscoverytrojan
Score
6/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10