Overview

overview

8

Static

static

7

b9c50cf3cb...94.exe

windows10-2004-x64

8

b9c50cf3cb...94.exe

windows11-21h2-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    b9c50cf3cbaa07e1e142dfdd0520a028001685043e5b00494a8d04d20c9dc494
  • Size 10.5MB
  • Sample260212-rqch1set3f
  • SHA256 b9c50cf3cbaa07e1e142dfdd0520a028001685043e5b00494a8d04d20c9dc494
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationratspywaretrojan

Malware Config

Targets

    • Target
      b9c50cf3cbaa07e1e142dfdd0520a028001685043e5b00494a8d04d20c9dc494
    • Size 10.5MB
    • SHA256 b9c50cf3cbaa07e1e142dfdd0520a028001685043e5b00494a8d04d20c9dc494
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Detects DattoRMM software

      DattoRMM is a remote administration tool that can be used as a backdoor

      backdoorrat

    • Adds Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Modifies Windows Firewall

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/FindProcDLL.dll
    • Size 31KB
    • SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 14KB
    • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/SimpleFC.dll
    • Size 175KB
    • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/SimpleSC.dll
    • Size 61KB
    • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsSCM.dll
    • Size 5KB
    • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/nsisXML.dll
    • Size 11KB
    • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      AxInterop.MSTSCLib.dll
    • Size 240KB
    • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      AxInterop.ViewerX.dll
    • Size 40KB
    • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      CagService.exe
    • Size 19KB
    • SHA256 74c94094f7fe86c9969093456c4c167f129f9e1943c29c669b8e57cce3b3b07d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      Common.dll
    • Size 16KB
    • SHA256 ab94b6aace3b74ed0fa4a70a199606e1bf8c312b81d1c075f1b3a40e47922cba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      Core.XmlSerializers.dll
    • Size 10.6MB
    • SHA256 0df23b577e3cb2cf8b1fc356eb3a70faeb89e3974871855e2c2ff33953053371
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Core.dll
    • Size 2.3MB
    • SHA256 87af304c8fb7c84b15f160331e1a4c803eeb6f4632499875a7d8f438353dcc63
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      CsExec.Service.exe
    • Size 17KB
    • SHA256 b400644c9d4762d6d9649b8005338b2bef76b4f8704cff794b859c46ec1ee924
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

installerbackdoorrat
Score
7/10

behavioral1

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan
Score
8/10

behavioral2

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10