e877429d2afff2977497e4c9c379b2c6a140143d7df19478344871e05be8ad6c

Sharing

Copy URL Twitter E-mail

General

Target
eDEX-UI-Windows-x64.exe
Size 67.3MB
Sample260502-werwsac121
SHA256 e877429d2afff2977497e4c9c379b2c6a140143d7df19478344871e05be8ad6c
MD5 20beff9c4cc991a27dbc24e61067f37f
SHA1 0c65ad7d5f4a58be8533aca3e1477fadbc41c663
SHA512 ac68cff0b7d772a57bba95efafe52073c6910495ebf0a0889e9306bb460b4d5c916c18906af13c6a655bfcee53478a23721f59d698614c30911dae455cfe697d
SSDEEP 1572864:sUsupvKvEGsVn6879Q0Pmuj1nUBw4rz/oygN6GPdxCCPDlCw:sRupveEP68h1z5UBw4rzAxPdphCw
TLSH
T138F733347886C3ECE98D0FB1AABC498B4709E995801431E54BFD75CD7738CB2AA1E54E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  eDEX-UI-Windows-x64.exe
- Size 67.3MB
- SHA256 e877429d2afff2977497e4c9c379b2c6a140143d7df19478344871e05be8ad6c
- MD5 20beff9c4cc991a27dbc24e61067f37f
- SHA1 0c65ad7d5f4a58be8533aca3e1477fadbc41c663
- SHA512 ac68cff0b7d772a57bba95efafe52073c6910495ebf0a0889e9306bb460b4d5c916c18906af13c6a655bfcee53478a23721f59d698614c30911dae455cfe697d
- SSDEEP 1572864:sUsupvKvEGsVn6879Q0Pmuj1nUBw4rz/oygN6GPdxCCPDlCw:sRupveEP68h1z5UBw4rzAxPdphCw
- TLSH
  T138F733347886C3ECE98D0FB1AABC498B4709E995801431E54BFD75CD7738CB2AA1E54E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/ConinMode.ps1
- Size 3KB
- SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
- MD5 dec84b4f7859e44892e0750c83fd693d
- SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
- SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
- TLSH
  T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/DebugClient.py
- Size 1KB
- SHA256 3b673edfdf440b7053a2de410cb6b6515b83842dbe7b4c1e990f2fdf0741593d
- MD5 ce2ef98c020c27b8b96808f2db18ff7c
- SHA1 33368b707a882319b48b06b5c28e4d901f328fc9
- SHA512 3a5c1884e8e30db8bc44ee84cd7cf45fad1b7d3f2204edfaff3bf825144aa57e143feb56dafe5b9e1040af2ae15224496c514e8738cca5b3616eacf0a0fd69b7
- TLSH
  T1B131DA0F32001B9A195306705541B8A8732A31AF3F77310060EDF7649B1A06B41FBE54
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/DebugServer.py
- Size 2KB
- SHA256 5b7ec9a26db8e18b7f08c70dc3d0177721d7c441305ae2b9c16181879dc1b642
- MD5 715581b70b84eb7947b895b9efd42444
- SHA1 d9830e42a3a0978ec8ea99de85cb8ff62e724a8b
- SHA512 01aab65a6d2f4147142e57b6cf3840fe664fd7add09b1bedc690b3ab0eb07b9c7c544a7a1b0fa710c7dceb020382fab6572ae13c8b44e1641b33d7199eff2348
- TLSH
  T19A418A3E321047DE24432AB06556D060B71771EF2B76721876AEDD601F2D03DC2F6788
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/misc/IdentifyConsoleWindow.ps1
- Size 1KB
- SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
- MD5 d0568512a8b58a101d43c7c961ad50d0
- SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
- SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
- TLSH
  T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/build-pty4j-libpty.bat
- Size 1KB
- SHA256 569581fbbad4e458b4c3e4759ed31586c2d252995e6bae06e104d48df22c5133
- MD5 c5def6f362cbf26a30e33dbbebb29755
- SHA1 2d77b39572009a145eb2259b10f098b147daf3d9
- SHA512 0bec43edf7f4414544077ec962a730fec4400cff35e76d131fc974e41d3d0603fd3643584cd69f4621acee399579d4ae206728bbc0af735152dc501f1b06855c
- TLSH
  T17A214936520A1FD3F2021FA5DF24B56AE73A862255ED512D301D814C7B27F8A3099E57
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/common_ship.py
- Size 1KB
- SHA256 92e7430fb2c4d19f2e69ec4d7a9e64d93256b29a38ba6ac964fc1372a51a4716
- MD5 ea845831a06d2c1717b63a5d482a451c
- SHA1 7fd607ab9f06441eaba1b1ce8b46bf362c3d62f5
- SHA512 6f1e61a07b91c0f70960af6f465fcdf5f3a79d536145a9a65316c3431b5cd25e9ca6613dfed61bd87241791b8624d58cd8e2b8ffc71c8fbe05988071c494354c
- TLSH
  T12B31EFC38D842820E6424B9F4803A49A4B66E9A73B122124B7DC81658FAD498517C6F9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/make_msvc_package.py
- Size 5KB
- SHA256 e149ece3fdc97ae4f9263df0c9697cc2f5e372a6899f081a9a81d840d22f3cf8
- MD5 7cff32e87d7d89ed9052b5df6a99f26f
- SHA1 4fd3a24458dc62245f5a06e8736b35bfdff6f8ae
- SHA512 d2ab37979e2c66656155a5fe357fa3ffb1e9e374623e427cdf1470e10ad81c7b676c30538c4177dc1e6c7cdcb16eed308e1cc2523d57676b2885c8c5fb4f492e
- SSDEEP 96:ANsYQHWSoN6Xk2dNziKAX+gtsrKbCn2qon1t5rzSl+iStnbvk608B8J89857o7qe:AjQHWSJXVTAzsrYVnP0APCQ3
- TLSH
  T1C1B15647C2B4876203434E9536AEB54D5A3B77233B11A48C729CA2881F1F5BD85FB5E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/ship.py
- Size 3KB
- SHA256 6d0c347813e68534d7e6707e65bdff72b4b30eed0f395a64783ef4538f55ef3a
- MD5 e29b532c8a02c94736032888b095be53
- SHA1 8d9c3c07cb7ffc642d00a3e17b8494b9fce3179f
- SHA512 76f35d92e2ed9f36c7ae40396e13daeff7a14e00bdbfc0d5c358cbfea1c5a5568a019a3911194f31cf792cf28d43961f9400e439ada239941f16fa12d0cd20d0
- TLSH
  T185816451A3450B6264D23754763A3B4F67B3B2773FA12C0436AEC1849F5E82F90B393A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/src/shared/UpdateGenVersion.bat
- Size 578B
- SHA256 d8538fcfd4cc94f158d155bbde491e82f358a67c117eb721ddc6a96d5521159b
- MD5 7536ea63e6007a4a3c0c6648a9e6ae00
- SHA1 46c02f9fe1ff85f9c597ca82a6cd2ee39a19c787
- SHA512 01cd0240b03a6e3ad2c4463a18fbe26aab4c08c1a52503a0c8ccede97ffa4e7088e0f9fb6b1a658c4b1e7dac30e96fc7add53369ed9131d561e4d59487453bd4
- TLSH
  T10CF0A2D7244D913848402685B67E94DDF35443F23639A5542E077C53B31948A974DF70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/vcbuild.bat
- Size 2KB
- SHA256 01556c0d8e463bb7cd907b6c2e15bb28ae527dc910146f3bde93c214a1de19f4
- MD5 59ffa9d4add00024f05134e681c63f5d
- SHA1 6a59aa5088808b58116da756a32d2e2db0253777
- SHA512 b7455d64d0d322c72fe467cebb8f6660dc13967ee9204d4c54346d80301fafb24b4d6c52b62b7b62aa196d1befa0c9b95da669ebfaed4c2c423b11ac11276167
- TLSH
  T17A41ED1A5CC942B770B0CE633950B355E537804F2F6E512E34DC4268973E14A4EFE27A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/node-pty/lib/conpty_console_list_agent.js
- Size 775B
- SHA256 0a9c63c2a054f6f0843dbc310fd7fa7de87a1483980ced58fdbea52a4af3f14c
- MD5 f6ad74fda649964d07434a14ab5a2ca8
- SHA1 72c55d1d935bb8291b36339db91372420017221e
- SHA512 ae422c00ed398dada6d3f6ca506966da24e79c3f5adcd7a77718f894b4992d45f11d7c2f61c0b758fad4ab338ab4ed2f53b7552edcec14fcb7b0538572270955
- TLSH
  T1930185654CFC49B902E80E837819CA832ED8CA6022EBB9703D74E1AD5F825D0A0538FD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32