General
- Target ChessBotX(Mid_April_Update).rar
- Size 38.0MB
- Sample260416-e9ndeafv2r
- SHA256 abb241f219e19a0226dbfc84d78e17a9a024996fcca32d7bbbeec39ce535ea2b
Malware Config
Extracted
-
ps1
-
exe.dropper
https://tihunting.com/Setup.msi
Targets
-
- Target ChessBotX(Mid_April_Update).rar
- Size 38.0MB
- SHA256 abb241f219e19a0226dbfc84d78e17a9a024996fcca32d7bbbeec39ce535ea2b
Score1/10 -
- Target ChessBotX.exe
- Size 100KB
- SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
Score10/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Installation_Instructions.txt
- Size 1KB
- SHA256 6a995dfe9d0af9ab8c4e78ad81de5c9589ecd2cdbde82818822547ad94f8bf49
Score3/10 -
- Target License.txt
- Size 1KB
- SHA256 4619d1e3ef029ea8810880955f39e9d9e6a29793f4acff91b44c70fa910bbf8a
Score3/10 -
- Target Readme.txt
- Size 1KB
- SHA256 72cab35a81b90d825c9875fea6ae6e5d2bd5c16b0d8ae0864eed81bbf6fa9b09
Score3/10 -
- Target Terms_Of_Use.txt
- Size 1KB
- SHA256 bc8ce49abf3581814edce5cc17a5c242bcd9ab38ff9dd705724a222be7687642
Score3/10 -
- Target active_desktop_render_x64.dll
- Size 7.9MB
- SHA256 cc6920f5e93bf9faeb2ef179d8bd7bd074149211f5f038167bea1e5303a7a9e5
Score8/10Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
Executes dropped EXE
Drops file in System32 directory
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target lang/Language.txt
- Size 1KB
- SHA256 8ae0d4824e48db6019655a9e15c859440efdcf74cef80ed48837bf5eb6285b73
Score3/10 -
- Target lang/chinese.dat
- Size 12.4MB
- SHA256 c6bb79b70464fb4eaab3b6c3d0af660feef4b2412d6c98bb0af4f39fd612bef5
Score3/10 -
- Target lang/english.dat
- Size 5.2MB
- SHA256 0db4bdb72ab911d42ef9a6ed75e6f3ef2240daf0fefd8dd2ee141497a8dbaef8
Score3/10 -
- Target lang/german.dat
- Size 5.8MB
- SHA256 63e579a1ffed5874cc0fc89fd32e5c69eb4d521ed74457251d1e37223b169dc0
Score3/10 -
- Target lang/russian.dat
- Size 5.5MB
- SHA256 d9433bda1cadad8a309717fa5b697acc007a53e62973e97eaedfb88ca56e36ba
Score3/10 -
- Target lang/spanish.dat
- Size 5.1MB
- SHA256 d279caac3d68e66825f2c2c0c79115263e78edc6d91e21295cb04128d7ff172d
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2