846aee828e4b5e52ca66aceabb50b4ea9a07b2b80e2440f6deebf66e20289a12

Sharing

Copy URL Twitter E-mail

General

Target
Setup__en.exe
Size 1.6MB
Sample251001-tchtzsal2t
SHA256 846aee828e4b5e52ca66aceabb50b4ea9a07b2b80e2440f6deebf66e20289a12
MD5 3ebca35d47ee15b31274080bc4649c8f
SHA1 f9f5bab5f4acd9c98d04c639f4c14ba1b8de3368
SHA512 deced414b1f0c6e4439c678e789c81b5a0f7b9412313c2a90435b93a9b9ff1d8dab1eaa0ffe1eee70fadc5b3643435db65e3fcbd922d699d0b1bfaae75e5e5e8
SSDEEP 49152:eLzQZ0G8E4nQTZZlZTjvdM/TGNIGQMzz813j/Gahs:+zQ+tzn8TdMymLMs5+Ws
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Targets

- Target
  Setup__en.exe
- Size 1.6MB
- SHA256 846aee828e4b5e52ca66aceabb50b4ea9a07b2b80e2440f6deebf66e20289a12
- MD5 3ebca35d47ee15b31274080bc4649c8f
- SHA1 f9f5bab5f4acd9c98d04c639f4c14ba1b8de3368
- SHA512 deced414b1f0c6e4439c678e789c81b5a0f7b9412313c2a90435b93a9b9ff1d8dab1eaa0ffe1eee70fadc5b3643435db65e3fcbd922d699d0b1bfaae75e5e5e8
- SSDEEP 49152:eLzQZ0G8E4nQTZZlZTjvdM/TGNIGQMzz813j/Gahs:+zQ+tzn8TdMymLMs5+Ws
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/Exclusively.ppsx
- Size 255KB
- SHA256 4f83e8c559b4be0f9ae4ac24bc0ec06fad98656bf2afe14eb688a512736dcf69
- MD5 1a0fc1aca0ea70b739953ad2c899f2b4
- SHA1 2dcfca0e60cb3d10af400aef7bf833d17c75b947
- SHA512 519634c38750620c910025f1abb88db837f5940907bcf22c172830f1c7f2073567eea0413b33ab716b6b8cf4d55b495fb3102f5fdc6e82a0bc89eebb59e45a1b
- SSDEEP 6144:1AjpoA+iipc8wTFiQyX/5vVQdXrHGjRoCKLli:1AFohpgTFiQyXBydYSY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $TEMP/Fantasy.ppsx
- Size 132KB
- SHA256 cec1489a6b0011f23376bb647deff4552a20c6b7a464848ec0b491aaa4390437
- MD5 b8847de8a5ad4b98711b98891ce59dda
- SHA1 0f2dd6f533dc21410b5b0f442ea150c7f1f1d883
- SHA512 b4beee929554b1dbcacd22bc5ffd7e3459384c446c29222d7a828acf530f73e029ca2b075c542e50f670335ec1d6712a2d8df51446175ed0be049065fdc3a395
- SSDEEP 3072:+u0W0RMjl/ThUCzQINaayH337AQhgNs1oVUEmR4eQIsFFEP3k+:vbKCThn6H337An2oiM7FFqU+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  $TEMP/Matrix.ppsx
- Size 150KB
- SHA256 0a8f511f0facb1ae95691988c61aa432c323bf77d0616549285e8623a0f98ef8
- MD5 d5f88a089b880b034b47eec617dac888
- SHA1 db0732dfa0cb6aebd6f9e16f471ebb00aca9eac4
- SHA512 efd7b75a46b840fc83bf79c91e9bf510adc2a83fc6b7297afabf9e86d3312585fa59136b96da51ef3c341219d69f98345a973d40a1ec383df666507194e09404
- SSDEEP 3072:G47T4k24/ZnwVwBSWTIweRgGZ1PZsivAdy/2yWCRIO3gxn/EGIWWI13:LX4Jm0wYhCC1Rsivey/TWy3gxn/EzZIR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  $TEMP/Pain.ppsx
- Size 16KB
- SHA256 a5c1e782a99b82fa57fa4fbc1856b82db27a99d80ee5434b6d6ef59d0b5206d2
- MD5 0d106ca7ff01d5c6a00fe962fa17b0f5
- SHA1 2b71af0a1db2a1f5c6f443d6dfd418c8e7102b13
- SHA512 4f81423effee60e48b6ed5f5529740490fd9ac80577b5442a52b6efbbe960a0ff852f71c04d651844aa26b96d66bf6b5c301eda6bf402de4a7c84746d9de6a31
- SSDEEP 384:RFONmtu92LgvDZ8dmPS2pHpMRfYNwgWcpC259CiBUkVd31a:n8gLOVEmzpHpMG7rz93la
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $TEMP/Tablet.ppsx
- Size 264KB
- SHA256 4d131bca140cda86d56dfb3d09a68f4d10be91103f0177a12ae4a86f35770c72
- MD5 eed7916604d913eaf859c0e8dc131846
- SHA1 549cd4a4af83303e40b3c9ebcf964be4a138c0bc
- SHA512 5b6107abb9218e8a60d2ddf9e1ff87f59b42c039f58d3bb57ae6b3371e27202f9f68981212e12d12d237925463c261771aa7552771f5b05ada517279dfda1c2e
- SSDEEP 6144:XTMOKlROiFTjiOtaeXuwB6Bqu0Fdp4SmZoGnl24hsxqwi+7vA6:jKlRfTRUeZ6Bqu0Tzulhsqwi6vB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $TEMP/Vegetables.ppsx
- Size 213KB
- SHA256 81ba6ed8de24850435405344b89bcca366f6ab344e648f91c292055698d88b75
- MD5 c53ea06daeb4e2284558736a21b571e7
- SHA1 bed65e9cc7120aefc111bd0667f438e17df50507
- SHA512 35226d5c8dc4444c3eed0ba5520beaa6c439778e004238c3f802b05506d3366a5e39ac1f301027d55714a1242fce61f3cea2406f33eb5f37120b18ab10fbdfe5
- SSDEEP 3072:NTjq/X/axBBUpwK+xexF5PwReQ57ZGkdzZo+ziTLIqnsudsbKB/S1CzHHK4kYa3I:NXYXySajXRxo0CLIqns8B/SoHDkQibqT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16