Overview

overview

10

Static

static

10

Toxic/ Dot...er.exe

windows10-2004-x64

1

Toxic/ Vap...er.exe

windows10-2004-x64

8

Toxic/000.exe

windows10-2004-x64

Toxic/004e...bb.exe

windows10-2004-x64

7

Toxic/027c...d9.dll

windows10-2004-x64

10

Toxic/0283...5e.exe

windows10-2004-x64

10

Toxic/0364...d0.exe

windows10-2004-x64

4

Toxic/1002.exe

windows10-2004-x64

7

Toxic/1003.exe

windows10-2004-x64

7

Toxic/119.exe

windows10-2004-x64

6

Toxic/131.exe

windows10-2004-x64

3

Toxic/15c0...8c.exe

windows10-2004-x64

7

Toxic/21.exe

windows10-2004-x64

10

Toxic/26b4...39.exe

windows10-2004-x64

Toxic/323CANON.exe

windows10-2004-x64

10

Toxic/36dc...ce.exe

windows10-2004-x64

1

Toxic/374e...05.exe

windows10-2004-x64

10

Toxic/3_4.exe

windows10-2004-x64

7

Toxic/4a8b...d5.exe

windows10-2004-x64

3

Toxic/556e...5e.exe

windows10-2004-x64

10

Toxic/58bf...1f.exe

windows10-2004-x64

10

Toxic/5a18...3e.dll

windows10-2004-x64

8

Toxic/5a76...25.exe

windows10-2004-x64

10

Toxic/5d40...3d.exe

windows10-2004-x64

10

Toxic/5d49...fe.exe

windows10-2004-x64

4

Toxic/6472...41.exe

windows10-2004-x64

7

Toxic/6B97...et.exe

windows10-2004-x64

3

Toxic/731a...61.exe

windows10-2004-x64

10

Toxic/7601...81.exe

windows10-2004-x64

7

Toxic/798_abroad.exe

windows10-2004-x64

7

$PLUGINSDIR/$_76_.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    250619-rgqpaagq71.bin
  • Size 420.8MB
  • Sample250619-whfmxsem71
  • SHA256 d480cb485075e7faad2c5b863f98d0c546827a8bfe1a9611e1be09b8dd5bca90
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaaurotunazorultblackcatdarkcomethermeticwiperlummamimikatzmodiloaderneshtanjratobliqueredlineremcosrevengeratsectopratthanostrickbotxmrigzebrocyguestguest1111hostlimaspackv2bankerbootkitdefense_evasiondiscoveryevasionexecutionimpactinfostealermacromacro_on_actionminerpersistencepyinstallerransomwarespywarestealerthemidatrojanupxvmprotectwiper

Malware Config

Extracted

Family

  • blackcat

Credentials
  • Username

    CREDITONE\Administrator
  • Password

    K3ny@2009
Credentials
  • Username

    CREDITONE\bexec
  • Password

    CloneD1sk4Song$%
Credentials
  • Username

    CREDITONE\KLarry
  • Password

    Kl..2021
Credentials
  • Username

    CREDITONE\BKuhl
  • Password

    Gromit2021!
Credentials
  • Username

    CREDITONE\rlopez
  • Password

    Victoria7856!
Credentials
  • Username

    CREDITONE\EJaramilla
  • Password

    1LoveVeros4
Credentials
  • Username

    .\Administrator
  • Password

    $fiji12$
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    7954i9r

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Extracted

Family

  • darkcomet

Botnet

  • Guest1111

C2

  • 193.242.166.48:1605

Mutex

  • DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Extracted

Family

  • redline

Botnet

  • LIM

C2

  • 195.3.223.120:25539

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Extracted

Family

  • agenttesla

C2

  • http://193.56.29.110/divine/inc/4e9eb8fc30c033.php

Extracted

Family

  • lumma

C2

  • https://battlefled.top/gaoi

  • https://narrathfpt.top/tekq

  • https://escczlv.top/bufi

  • https://localixbiw.top/zlpa

  • https://korxddl.top/qidz

  • https://stochalyqp.xyz/alfp

  • https://diecam.top/laur/api

  • https://citellcagt.top/gjtu

  • https://saokwe.xyz/plxa/api

Extracted

Family

  • azorult

C2

  • http://benchadcrd.nl/gate.php

Targets

    • Target
      Toxic/ DotNetLoader.exe
    • Size 37KB
    • SHA256 0d7d4dc173c88c4f72c8f9f419ae8473d044f4b3e8f32e4a0f34fe4bbc698776
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      Toxic/ VapeHacksLoader.exe
    • Size 414KB
    • SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoveryransomware
    behavioral2
    • Target
      Toxic/000.exe
    • Size 6.7MB
    • SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasiondiscoverypersistenceransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral3
    • Target
      Toxic/004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb.exe
    • Size 11.9MB
    • SHA256 004e0978725b0146ec5cf916f436526887bf54f8ea82142c6be994c07fd2c1bb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral4
    • Target
      Toxic/027cc450ef5f8c5f653329641ec1fed9.exe
    • Size 353KB
    • SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral5
    • Target
      Toxic/0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
    • Size 5.4MB
    • SHA256 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    neshtaobliquediscoverypersistencespywarestealertrojan

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Oblique family

      oblique

    • ObliqueRAT

      Remote Access Trojan discovered in early 2020.

      trojanoblique

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral6
    • Target
      Toxic/03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0.exe
    • Size 596KB
    • SHA256 03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral7
    • Target
      Toxic/1002.exe
    • Size 251KB
    • SHA256 5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral8
    • Target
      Toxic/1003.exe
    • Size 255KB
    • SHA256 8cf50ae247445de2e570f19705236ed4b1e19f75ca15345e5f00857243bc0e9b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral9
    • Target
      Toxic/119.exe
    • Size 24KB
    • SHA256 431111e367629bea37db016682c6354303360cd1419c033a22a26115121ccfe9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistenceupx

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10
    • Target
      Toxic/131.exe
    • Size 2.3MB
    • SHA256 2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11
    • Target
      Toxic/15c069fcb2407bfeb791823dfb849f30df28ec00c8b4e2b27bcde99007cb618c.exe
    • Size 404KB
    • SHA256 15c069fcb2407bfeb791823dfb849f30df28ec00c8b4e2b27bcde99007cb618c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral12
    • Target
      Toxic/21.exe
    • Size 54KB
    • SHA256 8abb47ca7c0c4871c28b89aa0e75493e5eb01e403272888c11fef9e53d633ffe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverytrojanupx

    • UAC bypass

      defense_evasiontrojan

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13
    • Target
      Toxic/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
    • Size 225KB
    • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral14
    • Target
      Toxic/323CANON.EXE
    • Size 300KB
    • SHA256 fe32599d6f2d1a874b65928cfd01a87f9d0a83d2b1e30b8f1148c8ad8aefd985
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistence

    • Modifies visiblity of hidden/system files in Explorer

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral15
    • Target
      Toxic/36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce.exe
    • Size 74KB
    • SHA256 36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16
    • Target
      Toxic/374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
    • Size 456KB
    • SHA256 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    trickbotbankerdiscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    behavioral17
    • Target
      Toxic/3_4.exe
    • Size 59KB
    • SHA256 036e4f452041f9d573f851d48d92092060107d9ea32e0c532849d61a598b8a71
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral18
    • Target
      Toxic/4a8b7cfb2e33aa079ba51166591c7a210ad8b3c7c7f242fccf8cb2e71e8e40d5.exe
    • Size 622KB
    • SHA256 4a8b7cfb2e33aa079ba51166591c7a210ad8b3c7c7f242fccf8cb2e71e8e40d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral19
    • Target
      Toxic/556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e.exe
    • Size 1.8MB
    • SHA256 556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lummadefense_evasiondiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral20
    • Target
      Toxic/58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
    • Size 82KB
    • SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Disables service(s)

      defense_evasionexecution

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (51) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

      defense_evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery
    behavioral21
    • Target
      Toxic/5a18a29791cfb18767a43bebb61f923e64be7988235213678514007174f60b3e.exe
    • Size 44KB
    • SHA256 5a18a29791cfb18767a43bebb61f923e64be7988235213678514007174f60b3e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    defense_evasionpersistenceupx

    • Blocklisted process makes network request

    • Looks for VMWare Tools registry key

      defense_evasion

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral22
    • Target
      Toxic/5a765351046fea1490d20f25.exe
    • Size 377KB
    • SHA256 e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    azorultdiscoveryinfostealertrojanupx

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Azorult family

      azorult

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral23
    • Target
      Toxic/5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
    • Size 91KB
    • SHA256 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryexecutionransomware

    • Disables service(s)

      defense_evasionexecution

    • Renames multiple (56) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery
    behavioral24
    • Target
      Toxic/5d491ea5705e90c817cf0f5211c9edbcd5291fe8bd4cc69cdb58e8d0e6b6d1fe.exe
    • Size 416KB
    • SHA256 5d491ea5705e90c817cf0f5211c9edbcd5291fe8bd4cc69cdb58e8d0e6b6d1fe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral25
    • Target
      Toxic/6472cfa9feb2763707bd8f8fcb96ec876b97ca13cea1d70e0f63b69b955fb641.exe
    • Size 4.5MB
    • SHA256 6472cfa9feb2763707bd8f8fcb96ec876b97ca13cea1d70e0f63b69b955fb641
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral26
    • Target
      Toxic/6B97B3CD2FCFB4B74985143230441463_Gadget.exe_
    • Size 25KB
    • SHA256 5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27
    • Target
      Toxic/731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161.exe
    • Size 2.9MB
    • SHA256 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blackcatdiscoveryransomware
    behavioral28
    • Target
      Toxic/7601bb7c75658a2e6d3ea40258d34f70c26351a99c8730f37220286d7fd48e81.exe
    • Size 3.6MB
    • SHA256 7601bb7c75658a2e6d3ea40258d34f70c26351a99c8730f37220286d7fd48e81
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral29
    • Target
      Toxic/798_abroad.exe
    • Size 1.6MB
    • SHA256 2fd5b075ab9dffe8b421a4942ecdac322d8f0fceca597a644a6a9e631901e8bc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral30
    • Target
      $PLUGINSDIR/$_76_
    • Size 1.8MB
    • SHA256 f5cb4f1ad712e03a0381cf106a3c93c319aa14bc4ec4678afeee9ec03b576507
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral31
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

5
T1562

Disable or Modify Tools

5
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

13
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Virtualization/Sandbox Evasion

3
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

10
T1012

Remote System Discovery

1
T1018

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

3
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks

static1

upxpyinstalleraspackv2guest1111wiperlimmacromacro_on_actionhoststealerguestthemidaminervmprotectaurotunneshtathanosblackcatdarkcomethermeticwiperredlinesectopratnjratmodiloaderremcosrevengeratzebrocyagentteslamimikatzxmrig
Score
10/10

behavioral1

Score
1/10

behavioral2

defense_evasiondiscoveryransomware
Score
8/10

behavioral3

defense_evasiondiscoverypersistenceransomware
Score
8/10

behavioral4

Score
7/10

behavioral5

mimikatzbootkitdiscoverypersistencespywarestealer
Score
10/10

behavioral6

neshtaobliquediscoverypersistencespywarestealertrojan
Score
10/10

behavioral7

discovery
Score
4/10

behavioral8

persistence
Score
7/10

behavioral9

persistence
Score
7/10

behavioral10

discoverypersistenceupx
Score
6/10

behavioral11

discovery
Score
3/10

behavioral12

discoverypersistence
Score
7/10

behavioral13

defense_evasiondiscoverytrojanupx
Score
10/10

behavioral14

bootkitpersistence
Score
6/10

behavioral15

defense_evasiondiscoverypersistence
Score
10/10

behavioral16

Score
1/10

behavioral17

trickbotbankerdiscoverytrojan
Score
10/10

behavioral18

discoverypersistenceupx
Score
7/10

behavioral19

discovery
Score
3/10

behavioral20

lummadefense_evasiondiscoverystealer
Score
10/10

behavioral21

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
Score
10/10

behavioral22

defense_evasionpersistenceupx
Score
8/10

behavioral23

azorultdiscoveryinfostealertrojanupx
Score
10/10

behavioral24

defense_evasiondiscoveryexecutionransomware
Score
10/10

behavioral25

discovery
Score
4/10

behavioral26

discoverypersistence
Score
7/10

behavioral27

discovery
Score
3/10

behavioral28

blackcatdiscoveryransomware
Score
10/10

behavioral29

discovery
Score
7/10

behavioral30

discovery
Score
7/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10