Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe
  • Size 938KB
  • SHA256 08c29dfa0ccb747751c5ff3ccde88f7f8a5a87152121f75f60a886b14e86bf00
  • MD5 2363f93331fc792ae9cb5750043bdc89
  • SHA1 2fc0b7b4106a28ffe7f63f36ff64fe045e8f7daa
  • SHA512 a4a47c39e03c22844725b51ffd56f3ae01e9095733e8442eaba1fcf0e3a0e1edb127a6bf4b5ab8063614829db27919dea5a0e62f9e7d320e625fc498a603ad3e
  • SSDEEP 24576:PYrNtws0/BP9qDVgk7YIPo0NJ+ISzFKs:PM7YBlqDVbNNJNS0s
  • TLSH
    T10015CF0021796FA2F93C97F52649621883F9369F08EEE7740CE5B0E711B9F875A50AC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionmatiexkeyloggerpersistencespywarestealer

  • Family: Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe
  • Size 70KB
  • SHA256 c36f30481ce328712716ed35515c79075b411ac492164996e9078a540f89f4e2
  • MD5 30f515392358142b507a486d7ab379d2
  • SHA1 d1b8436f0d752e965dae8cc2459cedd5647d00ea
  • SHA512 208773ac0578e1099a3e4f47c50d6dcb938748182922fc73105179e66f9386225b6f3c65689fa6d23a620303e9ee8f1e7f8e16251f7aa2f3f47a4b4ee52d1c48
  • SSDEEP 1536:oT+dIkJg6exZOWCYsPlFAFbDNkgRO5JylSp4mlG6hK4UZygM:oBkMxsYylFAFDWgIyIGIK4UZygM
  • TLSH
    T1616312A4FBBE1DEFD4FF0533022E90121166E431109185979EF4BC9C7C24BB9D88867A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  blackwoodaptbackdoordiscoveryprojectwoodupx

  • Detects ProjectWood Payload

    backdooraptblackwood

  • Family: ProjectWood

    ProjectWood is a backdoor attributed to BlackWood APT group.

    backdoorprojectwood

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4
• • Target
    Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe
  • Size 625KB
  • SHA256 293d7e82688a0af531aca5d3197c2671d4c7be759463d71d1415438d91333aae
  • MD5 337dd03f1d287dcdb6471704d14aa3b6
  • SHA1 a13f40e7fadd226795a6a57bd5e5bd8b8fce568d
  • SHA512 7224d57da3b108ae2b28f380c50045cf7307a805c8a7c1ab5f9933074596172e2c52f5c74af8e219aee0f0ea95a2552dd6a6048acf5742171d6d0c63d54b4bea
  • SSDEEP 12288:96Hz52J2DT1mWK5u0MH/reKpvN7fxBLaAsNWGqgmeBWDroj43V:QHl2J21mWK5ufHiKpvNzPLaAsNWGqijQ
  • TLSH
    T164D44B76E60389F5DE7705F1054BFBBBA620DA0984328C5FD788CE90AFF6C22145D626
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerepoch2discoveryemotettrojan

  • Family: Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Drops file in System32 directory

  behavioral5behavioral6
• • Target
    Red-Flaged/Jigsaw.exe
  • Size 283KB
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 2773e3dc59472296cb0024ba7715a64e
  • SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
  • SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
  • SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
  • TLSH
    T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jigsawpersistenceransomwarespywarestealer

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Renames multiple (3957) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral7behavioral8
• • Target
    Red-Flaged/Locky.exe
  • Size 180KB
  • SHA256 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
  • MD5 b06d9dd17c69ed2ae75d9e40b2631b42
  • SHA1 b606aaa402bfe4a15ef80165e964d384f25564e4
  • SHA512 8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
  • SSDEEP 3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
  • TLSH
    T19404D0BB715D8806FF75947640CC2A23DDE3E8B091ADDE23A68346E78C852DC58C9727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockyransomware

  • Family: Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Checks for any installed AV software in registry

  behavioral10behavioral9
• • Target
    Red-Flaged/MuckModLoaderSetup2.1.1.exe
  • Size 84.7MB
  • SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
  • MD5 8f43e321dec9dd12d638776a36ee194e
  • SHA1 9a36263e9e95812c8d756f6ac16c00e229483927
  • SHA512 35d3e59c1326d76623981dcfadf670de64bd978f8720285b3818de50732d7cd89bcf6f5d46422739fdcd5e151d17f9ec65c508e6d18d029c5fd18b2455c273cb
  • SSDEEP 1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
  • TLSH
    T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiongenesis_stealerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: GenesisStealer

    GenesisStealer is an infostealer based on Electron.

    stealergenesis_stealer

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral11behavioral12
• • Target
    Red-Flaged/MyDoom.A.exe
  • Size 22KB
  • SHA256 fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
  • MD5 53df39092394741514bc050f3d6a06a9
  • SHA1 f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
  • SHA512 9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0
  • SSDEEP 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
  • TLSH
    T134A2E14996B41DFBC08707728AB3761197551538E0F99387E73C4F9FA0762A8F74E902
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymydoomupxworm

  • Detects MyDoom family

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral13behavioral14
• • Target
    Red-Flaged/N-W0rm.exe
  • Size 16KB
  • SHA256 fffe3c68f5caeea568830803b982c3e58ad3e101e0241614bf5e87d2c07e7ab4
  • MD5 9301efdf355b6379aef4ba98dab78718
  • SHA1 308ac5df7bf6fe34115522d685814a49778c5539
  • SHA512 6cb47cb290330ad694cd8224c518ad063db61ed530a41b3eca1f3bf5b425e7a03141e8a55f1568884fc1c7e4a2df63f82d16587ad81928bbd17081bfdba6e8f1
  • SSDEEP 384:c71T+Rh/1xo+/6KPN/FYdQ8bDKgJRaqcJl74CoBU:c7sxroXKxFgXbmVL4CoW
  • TLSH
    T1F672FA0067F98625E2FE0BB85CB3431052F5E6535A32D7DBACC850EE6863FD48602BE5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  downloadernwormworm

  • Family: NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm
  behavioral15behavioral16
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral17behavioral18
• • Target
    Red-Flaged/Product Sample pdf.exe
  • Size 612KB
  • SHA256 7765f79c31ac9fb10bc37a24b769738c61d2f562b0758c3a0a4ebe176ae0d7de
  • MD5 22e87999f93e9368b2272cdd49cf49d7
  • SHA1 68addbfad46359c58eb68dad524db6294838e02a
  • SHA512 4fff863181463b78b11523eda50ef67b80ae0964996fe4660db31fafa22f5a203551dbd15836534c3c426d2351ca6038a0d1eaeb1833b03c2ca9eefaff00e3e6
  • SSDEEP 12288:TMF/qkQz5Vj+OMR8HnTgLJuAliyJ5/wd8ln4R0tW1cPOVk:IFvS68HnTgL4yD/wzR0uc
  • TLSH
    T165D423636330C524D6FC48749CDBCB921661BAE38863634BABB4ED442DFA1D0F1A1F95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral19behavioral20
• • Target
    Red-Flaged/Remcos.exe
  • Size 92KB
  • SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
  • MD5 fb598b93c04baafe98683dc210e779c9
  • SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
  • SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f
  • SSDEEP 1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6brM:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7
  • TLSH
    T12F93C713FA4AD0B2E42591F146426F31CEBCBC3636492173D38FCA419D79892D416EBE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostdefense_evasiondiscoveryremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral21behavioral22
• • Target
    Red-Flaged/Rensenware.exe
  • Size 96KB
  • SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
  • MD5 60335edf459643a87168da8ed74c2b60
  • SHA1 61f3e01174a6557f9c0bfc89ae682d37a7e91e2e
  • SHA512 b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb
  • SSDEEP 3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx
  • TLSH
    T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral23behavioral24
• • Target
    Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe
  • Size 1.2MB
  • SHA256 b6968bc63433009553101e5303b880d403e2a2a0c6521694ddb122e25336ad82
  • MD5 342fe7a48d34f0eb772e4cc606fb71b0
  • SHA1 4579992d607dda5ab61c9b5ff92e10499826c40f
  • SHA512 b1d4a6afb0c51de519227a25ee7fe5f34bf02790d61c9d70a9edb42f6003e091c49a1148bed100bb2ba2d75d1e48edc26b1de61ccf2430069cfe65ba8a7538c3
  • SSDEEP 24576:tVxWxeVzdyMxGn3etxHGWIxMN7BOPlQbX8mS8jmEXp7RMuiMGZ1OkV95jbbeQEUz:PxWxSdyMxGn3dM9BOIFrLpvfK1B7Eeg
  • TLSH
    T1FF451254B2A0C827C9B946F20E31FA7107F91EDE6411D3C88DD4ADEF79EAF045A41A63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

  • Detects PhantomStealer written in C#

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral25behavioral26
• • Target
    Red-Flaged/Synaptics.exe
  • Size 764KB
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 85e3d4ac5a6ef32fb93764c090ef32b7
  • SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
  • SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
  • SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
  • TLSH
    T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorbootkitcollectiondefense_evasiondiscoveryexecutioncobaltstrikemimikatzquasarrustmexredxwormkeyloggerpersistenceprivilege_escalationransomwareratspywaresuricatatrojanaspackv2firstcredential_accessdonutloadergh0strathavocpurplefoxredlinestealeriumxmrigimpactinfostealerinstallerloaderminerpyinstallerrevoked_codesignrootkitstealerthemidaupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Detect Xworm Payload

  • Detects DonutLoader

    loader

  • Detects Havoc payload

  • Detects RustMe Keylogger

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: Havoc, HavocC2

    Havoc is an open-source backdoor and post-exploitation framework written in C++.

    backdoorhavoc

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Gh0st RAT payload

  • Quasar payload

  • RedLine payload

  • Suricata alert: Cobalt Strike Inbound X.509 Certificate

    Network activity triggered a Suricata alert

    suricatacobaltstrike

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • mimikatz is an open source tool to dump credentials on Windows

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • XMRig Miner payload

    miner

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Contacts a large (521) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Downloads MZ/PE file

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral27behavioral28
• • Target
    Red-Flaged/Uniformitarian.exe
  • Size 357KB
  • SHA256 b0e8491d0558fe31d0e2f591e7c09beb20321b5551b008dec47da8c1b14c28ca
  • MD5 c01c24af72defeeed00f9dd92f17d088
  • SHA1 4b62292bee5e31480ff76ef731252a2ac4a2507a
  • SHA512 ce7ebba8b1c34db6da527ea83781002eaf12a8a48b3886df2227c80d3dc57c7885f66765bfdfffb7f8d79d54271866808d6354d1c4fa7ef9375e6f67d8cee96e
  • SSDEEP 6144:dMm4CCsD9RbmZGgnCroDxzSc+WIG01nv50tf45xAyI/bDli5uTwFOCxlteEq3D1y:dMwpD9tQ3DIc+WI7Fqtf45zI/vliIpCz
  • TLSH
    T1027401407264D40AECA047710DBAE9F21761BEA2BEB2C20F3314BB6E7F727C5551A761
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloader

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral29behavioral30
• • Target
    Red-Flaged/VerifierImGui.exe
  • Size 4.5MB
  • SHA256 966437012d3312230a38ec8b025140a6f55932a60b012e5d0fe649c8a6b71b17
  • MD5 07a189f58bee10ea63188b80f35ee141
  • SHA1 f866b03f473ac2fb064af333c6e4049274af75ad
  • SHA512 6a99481b528e44c4cec756c6afbf62c918cfbbbce8728a70dbe1446110c6e6d01fbb006480535b7ae20269e59b6c73942146ce31c4e3aa5a012afd528b1bfda0
  • SSDEEP 98304:lGjW4HRD7eWKnxG/oM7CzWTEoYsQr4oPkInb0XTYafLGZ/eA:l0D5N/7GzWvYcoDmF6Z/eA
  • TLSH
    T1A9263355AC54F592E2E52FF4E8FBC8D3B5133E1214AADB4D82037AC2D6A2D5A181D333
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnetsupportrat

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral31behavioral32