d5b426bc6569086b367a780f54fafc285357ab72fd084cdbf71ce0b15a185d6b

Sharing

Copy URL Twitter E-mail

General

Target
Setup__en.exe
Size 1.6MB
Sample250930-1lqphsvthy
SHA256 d5b426bc6569086b367a780f54fafc285357ab72fd084cdbf71ce0b15a185d6b
MD5 242753fe48252f366637e42fd898a7b8
SHA1 e314e218e611b942e10a9eab1b392003efe96fab
SHA512 4dacab2a35f1a5cbf6e700ee81f0c4f9b138c0ac076a87ea20d69a2f16b03786ea964832c39076683a800e39be493cf0a76ab8fe99dc8cf3249a2b844cbc3c02
SSDEEP 49152:ZfbnhIwMkGy9vJflt5Wz9+/Do3xS+qsun780d:pNGy9vztYz9+83xSrt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Setup__en.exe
- Size 1.6MB
- SHA256 d5b426bc6569086b367a780f54fafc285357ab72fd084cdbf71ce0b15a185d6b
- MD5 242753fe48252f366637e42fd898a7b8
- SHA1 e314e218e611b942e10a9eab1b392003efe96fab
- SHA512 4dacab2a35f1a5cbf6e700ee81f0c4f9b138c0ac076a87ea20d69a2f16b03786ea964832c39076683a800e39be493cf0a76ab8fe99dc8cf3249a2b844cbc3c02
- SSDEEP 49152:ZfbnhIwMkGy9vJflt5Wz9+/Do3xS+qsun780d:pNGy9vztYz9+83xSrt
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ReflectValium/Genome.msi
- Size 25KB
- SHA256 745b4832575e548f0eac5f4b3c11a3e8a930f90027a820d9dd337b840fd76a36
- MD5 316d2509869f71201bd392c02b5a97cd
- SHA1 c6998cb77923c0d18ed83fdfa08dbba60bdea179
- SHA512 8447cb9f75ea47b2b4010720c711e77a10306d00270ca544156a0475948efd58a0374fea7b3bd93fe74c34c7d3d49c9f27bb46b5972e74951caf027edb201317
- SSDEEP 384:vCF3BKfcBi8G/UJhm3khVfKqLOD47EY7FHV1oM2e6aDm/X+Warh4yGJYmGNK7Tg:s3Bvk8CoJVfugX7FHV1F2e6aDgOW8Vvb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

persistence privilege_escalation
behavioral5 behavioral6
- Target
  ReflectValium/Renewable.msi
- Size 216KB
- SHA256 be6762bc58a99c911b288a3a32e64d77e859d558a9a11f7ee3a6ead5a2a8ec5b
- MD5 57b48ac68d881f329fe156c1024b53ab
- SHA1 613a7372229bb1be75d72e0ac7fc6e118e39e067
- SHA512 3db53cef02d7ca58739e462499cb929a6943bf28ab05cd98d7ae4d605432d15fbef6f00209de60001a4a7e0631b1a0582cf2ab72da6473830e29b514a34196ac
- SSDEEP 6144:kyBTs2tRkmEd1Hw/gWad6jjYD75EfyhAuCJ+:kkTvtRWPw/SMIvC6hAJ+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

persistence privilege_escalation
behavioral7 behavioral8
- Target
  ReflectValium/Seas.msi
- Size 292KB
- SHA256 67889375f9f1dfb62e2f503a33c518e4041f18e02e7ed10182f0de64a929c6b0
- MD5 7a932e679b0c7644716472b21c7a4bf9
- SHA1 969ae52a5ce395fcf4b17f21ea1aeb590e26882d
- SHA512 5984dad50eb7387908fc2b35c91831a8c1ecd614d48958cbad2ca726607153d9bcb157c6ce78ab9c5c1097bd696fa32fe1102a67dc99de67bd0558e0cb1cb095
- SSDEEP 6144:ZOKLQgFetFO91Bu0uNmyZygOx7xHAxDsCYFFH4t5YLZFXGi67:ZZLQ0YFOLBu9Nmys97xHUUY7OvXGr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

persistence privilege_escalation
behavioral10 behavioral9
- Target
  ReflectValium/Talk.msi
- Size 264KB
- SHA256 a7cc2b3de934547619563aafebd661eb0d7cd396f0243e5fcb03a5396c2f6106
- MD5 83a988b2ed6c6674d7710cd945f15d69
- SHA1 de1eb7bf13a7c41305dd25d9721e6e9f5f750204
- SHA512 d4a4d7a7e070f2db2f7775e3d20ef8c3a9c450c261a0447ad9c892810dde3bd3ce71f1cde4baaef5f2a006d96a72b001a29677b0c2ee30f2b9b7cc5f8f01625a
- SSDEEP 6144:Y0AmoSrNJ2U/0wudJcLzLkD0CHeeakfHJx9toUaDVOZPDg:OmoSxYSHrWfHJx9t+BAP0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

persistence privilege_escalation
behavioral11 behavioral12
- Target
  ReflectValium/Ui.msi
- Size 220KB
- SHA256 58aee64da7d408177f75cd7bf6dad7812afe3ec8da464b05ca23af48aa616d31
- MD5 6aac45c9df5eb7c73f103a0db6dabd8b
- SHA1 1e5cc2cbeda6c857657e430c3103c5724c533348
- SHA512 bfe47151bcc28fbc0e7aed9bb13ae6d8e9164a8e01513ed2cd97e15aad15c0abd5a0adc3242799f707eb88982c94c56b96043cd6f6f48d20969c7317a556d63f
- SSDEEP 6144:W/lTP7AcuD0pDmpK9T3scBz+WoTjz4C2P:WRAcUpK5VgnzS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

persistence privilege_escalation
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14