Overview

overview

8

Static

static

8

AgentSetup...a2.exe

windows10-2004-x64

8

AgentSetup...a2.exe

windows11-21h2-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    AgentSetup_Document1214a2.exe
  • Size 10.5MB
  • Sample260504-w4psqaex4l
  • SHA256 015f182d2aa1edfa79a7d505cd9fdbdbf6f4ef8ef5b02d377e359e1de9fd2d3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationratrevoked_codesignspywaretrojan

Malware Config

Targets

    • Target
      AgentSetup_Document1214a2.exe
    • Size 10.5MB
    • SHA256 015f182d2aa1edfa79a7d505cd9fdbdbf6f4ef8ef5b02d377e359e1de9fd2d3b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Modifies Windows Firewall

      defense_evasion

    • DattoRMM remote administration tool

      DattoRMM is a remote administration tool that can be used as a backdoor

      backdoorrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/FindProcDLL.dll
    • Size 31KB
    • SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 14KB
    • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/SimpleFC.dll
    • Size 175KB
    • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/SimpleSC.dll
    • Size 61KB
    • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsSCM.dll
    • Size 5KB
    • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/nsisXML.dll
    • Size 11KB
    • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      AxInterop.MSTSCLib.dll
    • Size 240KB
    • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      AxInterop.ViewerX.dll
    • Size 40KB
    • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      CagService.exe
    • Size 19KB
    • SHA256 06d34513b05a11e0c7d353035d441d4a28d1682ecb6d3cc43816bd378ab14fe5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      Common.dll
    • Size 16KB
    • SHA256 b3dd496b276e315079754781cc8e92b1ff55411717f3fbbb213e21ed1c107040
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      Core.XmlSerializers.dll
    • Size 10.6MB
    • SHA256 5291a543ffa861bb0a41c1c5702244cb79d9158b24f80174725c45bd77e9ee46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Core.dll
    • Size 2.3MB
    • SHA256 2637e4c7fb3df53c75d2dc1b44f7ffd782197ce3a28826671803d1fe389bcf48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      CsExec.Service.exe
    • Size 17KB
    • SHA256 052df8a07aa18961ba81a2268dfc367c58ae6e6c36b16e2c5c0759f1cbfe114c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

revoked_codesigninstallerbackdoorrat
Score
8/10

behavioral1

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan
Score
8/10

behavioral2

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10