Overview

overview

10

Static

static

3

BINARIES/9...ad.exe

windows10-2004-x64

3

BINARIES/9...ad.exe

windows11-21h2-x64

8

BINARIES/BTZ.exe

windows10-2004-x64

10

BINARIES/BTZ.exe

windows11-21h2-x64

10

BINARIES/C...LE.dll

windows10-2004-x64

3

BINARIES/C...LE.dll

windows11-21h2-x64

3

BINARIES/L...X0.exe

windows10-2004-x64

1

BINARIES/L...X0.exe

windows11-21h2-x64

1

BINARIES/M...01.dll

windows10-2004-x64

3

BINARIES/M...01.dll

windows11-21h2-x64

3

BINARIES/dropper.exe

windows10-2004-x64

4

BINARIES/dropper.exe

windows11-21h2-x64

4

BINARIES/d...ed.exe

windows10-2004-x64

4

BINARIES/d...ed.exe

windows11-21h2-x64

4

BINARIES/fwclt.exe

windows10-2004-x64

3

BINARIES/fwclt.exe

windows11-21h2-x64

3

Drivers/atmarpd.sys

windows10-2004-x64

1

Drivers/atmarpd.sys

windows11-21h2-x64

1

Drivers/nkl.sys

windows10-2004-x64

1

Drivers/nkl.sys

windows11-21h2-x64

1

ESET_Turla_ComRAT.pdf

windows10-2004-x64

3

ESET_Turla_ComRAT.pdf

windows11-21h2-x64

3

KL_Epic_Tu...06.pdf

windows10-2004-x64

3

KL_Epic_Tu...06.pdf

windows11-21h2-x64

3

Modules/( ...00.exe

windows10-2004-x64

4

Modules/( ...00.exe

windows11-21h2-x64

4

Modules/ex...p1.exe

windows10-2004-x64

4

Modules/ex...p1.exe

windows11-21h2-x64

4

Modules/mo...1).dll

windows10-2004-x64

1

Modules/mo...1).dll

windows11-21h2-x64

1

Modules/mo...0).dll

windows10-2004-x64

3

Modules/mo...0).dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    AgentdotBTZ.7z
  • Size 13.1MB
  • Sample260421-sr7afsgz3l
  • SHA256 2d2919e6ef0309f0f3cb46ca4780426d82b86626f294d130fba900aa2874b0b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareaspackv2defense_evasiondiscoverypersistenceransomwarespyware

Malware Config

Targets

    • Target
      BINARIES/938b92958ded4d50a357d22eddf141ad
    • Size 308KB
    • SHA256 93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoverypersistenceransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      BINARIES/BTZ.exe
    • Size 73KB
    • SHA256 ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    aspackv2defense_evasiondiscovery

    • Modifies firewall policy service

      defense_evasion

    • Drops file in Drivers directory

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Drops file in System32 directory

    behavioral3behavioral4
    • Target
      BINARIES/COMMODULE.DLL
    • Size 219KB
    • SHA256 876005d20ac3c78192eff61cbf1e37891f18766880e0115a29b78060fd766529
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      BINARIES/LightNeuronX0.exe
    • Size 14KB
    • SHA256 14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      BINARIES/Module 101.sys
    • Size 221KB
    • SHA256 f3e4e1dece0a14bedbd02b123996316d90a99b8ba581dd1c45b52f33ee56f2e5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      BINARIES/dropper.exe
    • Size 1.9MB
    • SHA256 b9cb99988dfe872ffc675ab8f070b3ce75d36e422857b19d1e85e48ebeb508c6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral11behavioral12
    • Target
      BINARIES/dropper_unpacked.exe
    • Size 3.0MB
    • SHA256 c1dabb0fad907b42a1e8d4b130410671095b9e6b80e85d459563cd2fea0f7cd1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral13behavioral14
    • Target
      BINARIES/fwclt.exe
    • Size 1024B
    • SHA256 0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      Drivers/atmarpd.sys
    • Size 398KB
    • SHA256 65fdaf08e562611ce58f1d427f198f8743d88a68e1c4d92afe6dc6251e8a3112
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      Drivers/nkl.sys
    • Size 20KB
    • SHA256 0e57d8249bfada0083a0fcc8f38ca0c9e522ee57a804ea1d60362753382d8249
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      ESET_Turla_ComRAT.pdf
    • Size 988KB
    • SHA256 34b5317d04338f5d954a645e678edda2c8e39d5ad008d9e873c57bf9dbe64151
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral21behavioral22
    • Target
      KL_Epic_Turla_Technical_Appendix_20140806.pdf
    • Size 223KB
    • SHA256 fb4a95345dd159e20e37a4c73c8b58c8131f0a28751c7ac62efa7d59b62b5af7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral23behavioral24
    • Target
      Modules/( DEEFC70F701D75098D785B095E9E6974exe)00000000.exe
    • Size 1.7MB
    • SHA256 8c4c77eeef77986f771598ab9f316b3b9249d2c14eb5a817fc94b350b0c2d9be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral25behavioral26
    • Target
      Modules/extracted_p1.exe
    • Size 1.7MB
    • SHA256 8c4c77eeef77986f771598ab9f316b3b9249d2c14eb5a817fc94b350b0c2d9be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral27behavioral28
    • Target
      Modules/module(161).sys
    • Size 592KB
    • SHA256 c55fa19ac18710c56045e39724f3b6a83a916508ae23a14bb2a108e71eac64a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      Modules/module(2000).dll
    • Size 33KB
    • SHA256 e4ff7d8c1cdf48039640454025ff17cbe0f7e79bd561bd5ad8ff1e7aa5073754
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Safe Mode Boot

1
T1562.009

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

discovery
Score
3/10

behavioral2

discoverypersistenceransomware
Score
8/10

behavioral3

aspackv2defense_evasiondiscovery
Score
10/10

behavioral4

aspackv2defense_evasiondiscovery
Score
10/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
4/10

behavioral12

discovery
Score
4/10

behavioral13

discovery
Score
4/10

behavioral14

discovery
Score
4/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

adwarediscoveryspyware
Score
3/10

behavioral22

adwarediscoveryspyware
Score
3/10

behavioral23

adwarediscoveryspyware
Score
3/10

behavioral24

adwarediscoveryspyware
Score
3/10

behavioral25

discovery
Score
4/10

behavioral26

discovery
Score
4/10

behavioral27

discovery
Score
4/10

behavioral28

discovery
Score
4/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10