d9216e1491aa130a3595a688da9a5ffaca67a3bb7609cb069e86e000baba041b

Sharing

Copy URL Twitter E-mail

General

Target
processlassosetup64.exe
Size 2.7MB
Sample260420-v2verac13x
SHA256 d9216e1491aa130a3595a688da9a5ffaca67a3bb7609cb069e86e000baba041b
MD5 6344a3cfceb315a0354bcbd11a5f8a63
SHA1 39113fff4d7bdeaa1113517fe4ba6e41cab967f3
SHA512 303a3b4e42ad1d53db39396ce948483d1414e17b598c6fd02da272ace9a7da2e8f443985f05a5fabb92d6a8692836e709eaa2b3dcb4baaab7221731945bf6d9d
SSDEEP 49152:16yc3cg20kYjH/eC17hRCR38Ixuya+huxEyoTvigVqae1UFewWenn6m2Xk:1DcsI1Z1tRIcxEyDtae1cNT
TLSH
T1E5D5F1D509BA8DADD051DEBC8AC1CCC975CFAE0C953E3A3A5638350C6FBC79A6584C24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Targets

- Target
  processlassosetup64.exe
- Size 2.7MB
- SHA256 d9216e1491aa130a3595a688da9a5ffaca67a3bb7609cb069e86e000baba041b
- MD5 6344a3cfceb315a0354bcbd11a5f8a63
- SHA1 39113fff4d7bdeaa1113517fe4ba6e41cab967f3
- SHA512 303a3b4e42ad1d53db39396ce948483d1414e17b598c6fd02da272ace9a7da2e8f443985f05a5fabb92d6a8692836e709eaa2b3dcb4baaab7221731945bf6d9d
- SSDEEP 49152:16yc3cg20kYjH/eC17hRCR38Ixuya+huxEyoTvigVqae1UFewWenn6m2Xk:1DcsI1Z1tRIcxEyDtae1cNT
- TLSH
  T1E5D5F1D509BA8DADD051DEBC8AC1CCC975CFAE0C953E3A3A5638350C6FBC79A6584C24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  CPUEater.exe
- Size 553KB
- SHA256 ba69053cce7cee09c6261a2a8fbf1b9f53d13a11502fcd87cc7abc36c4c301a2
- MD5 99c42572fa391db9c94ec7bcec3e0bca
- SHA1 92f4504da0c6cfb5886486d367436aebe00514a7
- SHA512 e3166088a7b791ef7847fbda1ff26a8c0bb9109e3e3398bf4b13637b604d7474cf673225edc62324ac117434e3e3618a66e3443386953e657738726a963dcc0c
- SSDEEP 12288:4WIB9rbsr6eSKom+w5nH+uNcgQfs49FtH1:4WIBhPpw5H+uNcgf49jH1
- TLSH
  T140C48D94B2A481F9D0BBC239C9934406F9317C4157359ADF03D48AFA1F37AD58E3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Insights.exe
- Size 807KB
- SHA256 bfb46f5eda3746b53a321feb149bbe81048be4ba0a231da874736669a9b64e7d
- MD5 f74ae6a83b3c51d5ccc151404ca161cb
- SHA1 041ce5fdeacb74b21bd626800ebbe069577e0751
- SHA512 8f0c493dbbce4e651ab0dcfbc3812c323aa67ef47d4c18be905e84aae30df485ec616abc87b44640f6677c0cf28c04dce7507dc2d62caa1704b6053c6aa7c164
- SSDEEP 6144:eYOeKK64yffcp05XnhrWq+eID08l++VpgGOUJw5DRLmUiT3I8msWI7WGhvK:dOeKKQfcchKq+eIi+Lgi4pgYRNIKGhvK
- TLSH
  T1C505A1D055BA49ACD066CD7C8A82CC9AE8EB7D0C573D39BB02B4745C0F3EB994674E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  InstallHelper.exe
- Size 853KB
- SHA256 956924ad0f7d61779025c3bd039dee339227f28eb5598f1fded039772decf8e0
- MD5 0638ee2f4f3a03aa1ef68640da7a429c
- SHA1 0cb8d423b88c14a32a7b469310db9fe240f4a40b
- SHA512 be9a214c90f67c8dabcbd9cf4145711c8a8ef90402708b2ed51a5e4cea4930f2e5764114683d36587e2fb649f55aef89d23a1a4a6a7ffca2b98b56b161fc5521
- SSDEEP 12288:rBHsAyQCFwwP3XITXYyOPAC93hjsT6peLSdH03A0y/FWbKGqX:FMAhw/sXYyOPAC9xjsQUSB0QWhqX
- TLSH
  T1F005C1D056BA49ACD076CD7C8A81CC9AB9EB7D0C463D3ABB0274745C0F3EB994674E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral13 behavioral14
- Target
  LogViewer.exe
- Size 851KB
- SHA256 61b41a6599ff560dee4357e19ccbfc85973874267a656c3ec90840754fa503c5
- MD5 d094f2b317db33d38f0995aa1ff3b71b
- SHA1 fd0bada26348987f8d58afa932af24bae880537a
- SHA512 b52b7764e839738a3fa317104eadfcacdaaf2f91bf1eacd5dbc4c4c588784e52f8947a8bbc23e9da57cd49f452491d4cef0e668958593bcf1ff7590c98e67450
- SSDEEP 6144:HZrM8M5den4gYtZjkiv9AN2udihPE1E5OblygOtl4b1nVGoW47v6TqoZn8vrlZqQ:5w+iFMsfmVmZMrlZqOv5Vpl
- TLSH
  T1C1056C5DA2A842F5E176D334BA824616EBB17C1577609ACB03A07B9B1F376E04F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ProcessGovernor.exe
- Size 1.3MB
- SHA256 5cf88d196b5f600e0aa2bf32871446e60f48a80e6dae6629642fec4cb610b11a
- MD5 f1d91efc5a6b48a78fd4e3281e6ec55d
- SHA1 abd109657e3ddb1697021189b1e71357973591a9
- SHA512 7eae094f9346888ef4af7829b9edc2a00586f1aed9794cfa5222193cfd7740a0ea4c36a2d795d4f9532c0c4b8ff5a61c1d3677f0a16e74b1bf5e9f2ab54605dd
- SSDEEP 24576:+08jwatdhVf5Up78pJJldBnt7XxT9x4pWx08:+LkYf5Up7c9Bn9hT74pWt
- TLSH
  T19C5527D415B905ACE066D87C8A81CC8AE5EB7C0C073D7AFB02B436591F3EBE54A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ProcessLasso.exe
- Size 2.3MB
- SHA256 7a135a83c079c92c85a6ddb63425b2c0411958bc01a7b57593efe54ff14b92be
- MD5 6f430ce9c9e72522d3dc3abac14b5fb5
- SHA1 7f7044f3319d60d9d43c7abf0157d7d16e0bf9d2
- SHA512 d8888c32c71dfe0d884decb36e202ea16d35f6f5ab8019109144dd3745e72a8a3cfe2779d3895c69113cd411b74ce3d740ce903e503f47204b40f95b10b8280b
- SSDEEP 49152:OIFNK7mIX6oTWXepAKvB+YmUC7uk5hl6BWrtV+hO:1N6TIl7us+
- TLSH
  T13EB5489522A805A9E076C57C8986CC5BE9FB7C0C173979FB0160B9580F3FBE60A79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ProcessLassoLauncher.exe
- Size 400KB
- SHA256 bbe930f95c4e71f0b581eeb5ef7396851f558a00f45eb4a5d01b352fdab80c10
- MD5 80abc9e1bfc7283ab434b092968201a6
- SHA1 e83d74209efa04cfbe397282b0076f6ed50e8341
- SHA512 fcc621b0f5983831e2b88a22a2a10659ced383f5622f1243f168ade5510e60bcf60bf22bf45eb122a905577013baefd2e4ba439b935afe3a9f196297a4f339b3
- SSDEEP 3072:P/wE1YFBW3AYm2+huY6S8Oq1umgSZLb7Vk7HoZ7WK7T1mqP2:n403/m+YpIV7WGMqu
- TLSH
  T1B5942AD51ABA8DACD061DE7C8AC1CCC9A1DF6E1C463D3A7A0278341C5F7CBDA58A4D20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  QuickUpgrade.exe
- Size 487KB
- SHA256 52e674c0ebc9c303aea7f77e6f61b5389bc92005bb3450f9e262b4a5b655c087
- MD5 6f782f7c529b12940cc72d66607ac775
- SHA1 29a677f8399ae2f7d7c653cf974bba1bf8adc827
- SHA512 ea9a43082c558a141da1a9a0479c25a79e1b1cdab8efa85cc7943546a0d1116bd850873a0ee08ef7e23f2829c534340b8c27e7b964992311e07b89c201af1273
- SSDEEP 3072:Uwlw46gYUBoWux28XvviXx/S0L4ab+cH6myRmrf/JnQwqdz4VSIxDdWk7HoZ7WKx:Uwlw4NXug8fvk60L4OqXcU6Y7WGya
- TLSH
  T1B5B47ED11ABA8CACE461CE7C8A91CCC9A5DF6D0C463D76BB0278341C5F7EBDA5864D20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  ThreadRacer.exe
- Size 306KB
- SHA256 c5d178179c74abc372fd9bd6c5dc90e5d7809d6af0e9c559881afc37bf2d226f
- MD5 bee16fa2b803305b0883e3b2cdec4cfa
- SHA1 2e77cbfc9fac9d07f8f50dfd2a46f5b03d6044b1
- SHA512 1f7925a26f095c0f51e9bd5dfae5b9efc2d0bd45cbcd26922665ffb9bd60b6a6fb548e2bb5da9a826ad4922911a750d42adab731422685be212a1d7784169b46
- SSDEEP 3072:1h6tDdOPBPXaAKDRhFwPIxVTOS+cATYJy/OkpT4PFSkPd/YxenM8U/ePqBTnkyGH:fpPJKAC/lxUHPYBk293FIky3a
- TLSH
  T1E7641816A6A508E4F8F681398592513BFA7E38550364DBFB02934E562F236FC9D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TweakScheduler.exe
- Size 203KB
- SHA256 7967dc2dff60ad40fe6afc277cec213b579c66c7c65bc3f9b37432ea1fe40355
- MD5 c7d53570063f91c3510a847b7bac7375
- SHA1 028f96d2e8d89085bfdc9181da210bf8e4053eae
- SHA512 92e6308c41de08a297f187469ff072c09f52a7e07f6e60d219553d9be9e381933243fd3b16aa0bf6d192e2bb6ae6377682bc4031a6e51e2a87bc26d4dda61f90
- SSDEEP 3072:k4QI3pRNxdS3ydXdmNqn4QIfCtmFPyC9l6Gwjuh2:k41/Nx03yd0d/KRSM
- TLSH
  T169147D5673E510F9F1778234C9A14616F772B8651B60ABDF03A0837AAF236D09D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bitsumsessionagent.exe
- Size 180KB
- SHA256 8f6507c3bb877e85d15adb5ed62d10cac19d32a8e7960e2116a21a6f9f242c11
- MD5 c3781289e5ae15bc0e3bb0dbaeeb8cd6
- SHA1 a7d26d8f39b43e036f19bafe62c1d4a17bd63bfc
- SHA512 0be7b041c405c63f3ada0e525f6a1f0d1985ca0e7dff58f3d232962eaf41e1ce7b458ef2aed55e63cccc932df5f14fe1a4b69c2b55482e114c549b9d95abd7e1
- SSDEEP 3072:eaNn5AwjVsJu3hE38kojLVJ6DIrVHnT5xx+Xe2:eaBWJuA2hnN+5
- TLSH
  T1B3046C5673E510F9E1778234C9A14A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pl-update.cmd
- Size 40B
- SHA256 ab965ed0402b4c474fe6c988afee9957c5494c687745114fc80d1fb70fb071bb
- MD5 cd60ccd708d428df44ca1d454ad0d68e
- SHA1 83e3fb9ef19c7d3faabc0b391f96803652fda425
- SHA512 b400530473683de0f7cba3f206b38ba1a0a4d3156a06168c3db0391eb33be1cb6fa65e736c746067aac394d538fc35de8764c30978734bcf4e84392b3294c10c
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Downloads MZ/PE file

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32