irata | 9341c149daed191c30b5e7e7f752b04c780091ebd1fc70e1188468dbb6394722

Sharing

Copy URL Twitter E-mail

General

Target
Lexogrine-HUD-Manager-Setup-6.0.4.exe
Size 386.7MB
Sample251224-pdg7maxkby
SHA256 9341c149daed191c30b5e7e7f752b04c780091ebd1fc70e1188468dbb6394722
MD5 667bb92d25db89ac35bf9595394b9e07
SHA1 4980f11fc5aa3cef5fb87e7bce7ccc291bab425e
SHA512 eb30157743d3a7c1016384c9cf573c1657aae3ba71b8457748f0284b3ebdde2c59a06848b349d12e069437332679554e8780667224505a38a4e87e1e21eef35a
SSDEEP 12582912:n4cuHEuJuJri4AJLvJ12hUtmlwgpiw38w4gYCXU3ECYe6:4cukLJri4ARJghY+38wR5UY1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Lexogrine-HUD-Manager-Setup-6.0.4.exe
- Size 386.7MB
- SHA256 9341c149daed191c30b5e7e7f752b04c780091ebd1fc70e1188468dbb6394722
- MD5 667bb92d25db89ac35bf9595394b9e07
- SHA1 4980f11fc5aa3cef5fb87e7bce7ccc291bab425e
- SHA512 eb30157743d3a7c1016384c9cf573c1657aae3ba71b8457748f0284b3ebdde2c59a06848b349d12e069437332679554e8780667224505a38a4e87e1e21eef35a
- SSDEEP 12582912:n4cuHEuJuJri4AJLvJ12hUtmlwgpiw38w4gYCXU3ECYe6:4cukLJri4ARJghY+38wR5UY1
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 9.8MB
- SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
- MD5 0ff177fbf2a3873dd573077840e0b8f5
- SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
- SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
- SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  Lexogrine HUD Manager.exe
- Size 79.0MB
- SHA256 7638742ca4ffdf8f3c6257e4aead65cb57a466dd48cd87c328e17e290e1ef613
- MD5 12ed653623749f2673eddc6c80ef50b6
- SHA1 9ca77735ef9674546c445a3492e72d5e7644a61f
- SHA512 7fa0d45fce62dc948aa28e625de6c3d3488c3647ef9fc864df399a298270adbda8214db4a43e1067392becab34c095017a3e814dc42a0b725f0ffe1247d3fd91
- SSDEEP 786432:WMMD0PlYQSJUgPb3eG81D5QQsdRW8YcrVZX3eES:DMw5SJUgPbksdRW8YcrVEB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  argf/LHM NDI Finder.exe
- Size 176KB
- SHA256 f0818443f68c5bd7eb243413b5a618bcf07bb985239394cf8e6bcceb46b9311d
- MD5 6481aa05a431ede3f9e649a136cc244b
- SHA1 c3a5b492ce7bc3e5c925ec46be1d0163d7a89ee3
- SHA512 ac58c9a00d21a11123457ba259e027257b818a21fb3bf28fd6c5633828607a6462192a61d7e0138c4740086315c32f77b4626886d83e574fab7afcff1a52475a
- SSDEEP 3072:YaVm+fGSwWvmLqYr9djUyl2NR1CcxVseQISN5M5mvr0TJ6d0FS5uyPmxvPsJB3C+:Yam+fGSwWvmLqYhdjUy6FxgISN5M5mTl
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

defense_evasion persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
behavioral14 behavioral15
- Target
  argf/LHM NDI Plugin Installer.exe
- Size 243KB
- SHA256 c31963cc86ed9e358d3b52d0b7b4a55f077087fd784175cfe33045e4738bc2f2
- MD5 372147c2bdefe37e00bf2d410af8b385
- SHA1 8327092c08a52674cfba58d24f7fc53cc98f6fe2
- SHA512 12cfa4fef3ad82ae5642cd1b97ccd2a85ae1b15e5e28b917e988ba9fa59f9897480b400501e6fa911593baf47ca5a2115b1c3edf06215a5e6d55be540ad63a5b
- SSDEEP 6144:35aY6LjUiLnK+T8wC+fGSwWvmLlYhdjUyBcolrUK+/gne0UW9r+n8RJHtq:pH6/UiLnKX+eSwWvmLlYhd7BUU9r+8Dg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  argf/LHM Replay Feed.exe
- Size 249KB
- SHA256 a8d3fc7fa0c0551b9b9bd714dff3008da19f119abd39d4770c7ad07703185916
- MD5 1739a9fce9cd0463f21e8efc9906138a
- SHA1 811dbdb730742818d649a58069033bca1f12fa4e
- SHA512 7bb2f4b7d8541161f77615d1186edb358fc2a626949bf9add4bf3f4c608caf3883d7bde9dabb12ae7790a51b7ce59dfe8a8e1e62975f76ff43077554044643b6
- SSDEEP 6144:wEbVt/Ao+fGSwWvmLHxYhdjUyGTB/FW1Ut0rq041DcRBJkpFF:r5+eSwWvmLHxYhd7G7j1DcyHF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  argf/Processing.NDI.Lib.x64.dll
- Size 27.2MB
- SHA256 6bff766a6c0eaa07b6317e48bb5c9c1ee7c2389969bf6fadbe832cb9cbb7a8fc
- MD5 24f7c14510f4f000552c12e1dd0c228f
- SHA1 6226c17775197a8bf67295b6266c2d280edebd85
- SHA512 9afd2869df01bb04eaf28a0f294ef6b778e2f85ea58fcc3b7664088f80e67e3e0cccf3b6a869bf16fd6056cae2ce2af38e376f0f3dbc80e01de4b2cf32a483cf
- SSDEEP 196608:XKqPPY0BVhYBVu7cXjdhbHBayM5xXjdhbHBayBRMFOEQ1PviHdeLuDWfYX:bhYBVuIXjzbhK5xXjzbhA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  argf/avcodec-61.dll
- Size 85.1MB
- SHA256 d84c1d56ac085607225bca6dea174ca7a23ce202b65318605e3d151af0466355
- MD5 3731b7cc3cdff09e6b8775b32b6e3b36
- SHA1 1daa41ceac898f8eb92c19f586214a0ad295d9f5
- SHA512 f02e6a09953c6f07bace5d8598832cc34d91f8424fc6162cf2f137f364b3b8faedfb43762235cba9bf2078bfff0ffd305b85fc00fe44d4a0068675ab989b15f4
- SSDEEP 393216:nOhc7czQDzd5TDuJ02jjNTnvUI+Dlt17dSUqKv9eAJSqo5w2dT2ydG0g91d:nOhc7KjcDltzhv9epR5zTiv1d
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  argf/avformat-61.dll
- Size 17.6MB
- SHA256 db5636a41cf9d125a993359a6f0d963733bd4743bb333ea203d911e9f199eaa0
- MD5 f004f56603b83c60188a3789ab242913
- SHA1 1dd04fe5fda75637ef4c4c6aa0009574832e2960
- SHA512 00cbd7753b3eaf7413722433d59b29c3070d15f0e404df5ab37dbaba6a04c8f5984c4840440333018818901c936cd1a55e2b636a94d4b458f01147a07a5353af
- SSDEEP 196608:HRYi5KfpwRnTSpKTYDzclC9yVVz5bN2kzO:Q6lSpKomD2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  argf/avutil-59.dll
- Size 2.7MB
- SHA256 a6a71f986c0acf40bee8cc1f17b3d5cd300f65ed6c6a9c37a72eb0788ea6a602
- MD5 0df327beecc8a168674ede3ad39bd894
- SHA1 540a096ca14771c0cc2db7ff116ecdf9422390fc
- SHA512 9777b56e00ff8e7d71f9e4f0886b10b8baca629a09d0c36252acfb8b517893690aebb2628264bbded75cf34a350748dea4f852c8ccd2f3619cc0db4f849b9978
- SSDEEP 49152:dsqPeJxlCJtHqsGB1Aw2GJVDk7aVo1mwPS9v5heEJrjwu//z1AFqt:aye9CsxVmaHeS9v5heTU/zj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  argf/swresample-5.dll
- Size 428KB
- SHA256 2501936f861d6bdc874a6e5ba8d903b07d186d2f33a7a8d5866e7308ad14b940
- MD5 cc84b7936ff468fc36b12ce8daa75e52
- SHA1 e2987711b664502c71d2d2a042262de3721bc8de
- SHA512 589d5d3c306f98cef253264d5e14f74fb12957050c3ea54ac6a6a42cf4870ff38f158194b8d59b18622adbc83e3d8e4f8d632c2d3e394eaeae66e1ed1f1cb84b
- SSDEEP 6144:D8l1GIE4h3AtJcNoO6XAP2D0RTIiGc+/SEEGfGsN6USZNG5lZh:Dk1GIE4h3x8DgTAGzsP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28 behavioral29
- Target
  argf/swscale-8.dll
- Size 691KB
- SHA256 a745cf080f10b743f08b1bbcce2d4459708cbcb9045de7fcd82e4ec190dd9d78
- MD5 adaa9f37eda19bb11cc6fc913440c80c
- SHA1 49da30626ab7e53ac39e2c1cb2bceefdb7dcd8c3
- SHA512 603172cc36aba23d976999ee8fe213c21193f9b28d5b085e90053eece324e844360b0e9572960d878db9f8894c803e5da239ab0628b94ef666af70efd266049d
- SSDEEP 12288:V+VTMJdrEn5obXYmSvh+cYwj4Lus3XpYx364pt2xlrLkASmx/mNuzaFhmUwEYkoc:CTMJdrEn5obXYmSvh+cYwj4Lus3Xg36g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30 behavioral31
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32