82bddd66fc2f9f0f45468ae47d4c315a71bcc4bd15412b37ffcb9e9b7ed4d397

Sharing

Copy URL Twitter E-mail

General

Target
processlassosetup64.exe
Size 2.2MB
Sample260621-vkd2faes6n
SHA256 82bddd66fc2f9f0f45468ae47d4c315a71bcc4bd15412b37ffcb9e9b7ed4d397
MD5 744e185bc18efcb6f34d1894e5fbf040
SHA1 1a6d3714b4b2e1b187710ef3ea64e58b8925656b
SHA512 d3d36b6faf71f29bac61aa3ae7da1221f8fc12d0a5fde5c1e2d775b601d8438fa5b51385e780fa9170fa0c573903aa6281269c358d156b53f6f075743873293c
SSDEEP 49152:trrmP1Dj8Fj2KvSTmGpVOiD4EyWrpwt2KhIrFo4ZX:tOV892Kv/MOispWenYe4ZX
TLSH
T176B5E0C51ABA8DACD461CEBC8AC1CDDA74CF9E0C953D3A3A4678341C5F7CB9A2494C25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  processlassosetup64.exe
- Size 2.2MB
- SHA256 82bddd66fc2f9f0f45468ae47d4c315a71bcc4bd15412b37ffcb9e9b7ed4d397
- MD5 744e185bc18efcb6f34d1894e5fbf040
- SHA1 1a6d3714b4b2e1b187710ef3ea64e58b8925656b
- SHA512 d3d36b6faf71f29bac61aa3ae7da1221f8fc12d0a5fde5c1e2d775b601d8438fa5b51385e780fa9170fa0c573903aa6281269c358d156b53f6f075743873293c
- SSDEEP 49152:trrmP1Dj8Fj2KvSTmGpVOiD4EyWrpwt2KhIrFo4ZX:tOV892Kv/MOispWenYe4ZX
- TLSH
  T176B5E0C51ABA8DACD461CEBC8AC1CDDA74CF9E0C953D3A3A4678341C5F7CB9A2494C25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
- MD5 ab1db56369412fe8476fefffd11e4cc0
- SHA1 daad036a83b2ee2fa86d840a34a341100552e723
- SHA512 8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
- SSDEEP 48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL
- TLSH
  T123C19474B3C248B9C491413368AB33D36612EE746784500F9B6315AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  CPUEater.exe
- Size 607KB
- SHA256 f062764e46adf0758824ee4c8dd341ee953167b96d9c3392a37ca4b986b63066
- MD5 019249d601627361f9802296209021a1
- SHA1 b94d0363242532e329ef14e77463a3f9939dfdce
- SHA512 30c765457998d1b48d98e75d9c987ba3b22ea8fa31d6c103112aa7d1498918f52ba960d4f4c529e98b9aed49a4ca0b66df336ce5f363b5a96877ee027b7a4b11
- SSDEEP 12288:SzA7LiTOIn6ux+X7HPIr4r6Yd2EROBzVRY:SzA7WOIniTPxrmz/Y
- TLSH
  T1DED47D95B6A443F4E0B79234CDA39507E77178491F3596EF029083AE1F336928E3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Insights.exe
- Size 853KB
- SHA256 001135a183d37551d9cc6e5fc9d8e6e02c983e25e3d4ad47ad200856b55d8f5e
- MD5 5b7a2e418a8d780d29954391c49fdb5d
- SHA1 becaebc39faedf54a348eeb4202c0aaf3cccac3e
- SHA512 ae8b03b96db461a2796af43ee596fbfde63765b81f7c8adcc2f5c166ef8c80cdce81f5da0dc1d31948172d9ede0a2e28640b80b5522bbb201b77c467e855aaf9
- SSDEEP 12288:XaOCgiAC6Te+QROrMGPuwqca4p3hY6jWmFPts948fD:XbCgiD6Te+QorMGID486amFPmfD
- TLSH
  T11A05F7D126B948ACD066CD3C8A81CC9AF5EF7D0C163D76BB02B4715C1F3EBA54A64E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  InstallHelper.exe
- Size 890KB
- SHA256 ef162c0713df873df5367a55ad7ba5ffb4dddf81f3c9bcb111bd3eb2543e1476
- MD5 859296d0ea58b09f4d6a662a45e0d1e8
- SHA1 446a75a625fc39b52b9ea9c080e1e7ff755b8489
- SHA512 de946ef21657861f786f29d573cf77ebcfba41f3b29f5f5a9359a4e31f5670d654f71762c3755d7ccdcd80a543ea0fe1ec41bb3567dd3643e3303a4e7425ace5
- SSDEEP 12288:fsyIIiasMTRdH+eC88ROWIB0jOFxtoX8in48fe:fsyI/asMTRdHJMOWozFnosiFfe
- TLSH
  T17015E4D126B549ACD066CD3D8981CC8AE6EF7D0C1A3D76BB0274315C1F3E79A8A64F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  LogViewer.exe
- Size 706KB
- SHA256 70e48718230c1cbd9f45a9d5c393bdb238bd1023b2b5dba5d3746a6ce6ba2564
- MD5 ac0b711481b4a4ff08866dadfed2590e
- SHA1 011547a32e0e33639afee12d4f12315327a23e7b
- SHA512 99c5d0edceaf704e3e5df790e8c214d42412805cf67a2447598bee419a69ce75e25c86e8e3db9d49ad716baf87c683b575a1ac4fd94c833929b1ebfb0c7355ad
- SSDEEP 6144:KMgYPN3EhZx6S32GvwdPJlw8q0lFSE6dc+i++eX9At1OOWiaSE:jRSvCPJeqvSEqt+gStibt
- TLSH
  T15DF45B8DFA9490F1E077D335F9A78646E6723C447B618B8B1268B36F1F332904D2A725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ProcessGovernor.exe
- Size 1005KB
- SHA256 681631951a88e3b79763c6ef4b3ff0483472206a96116ca234aeacbb96293abd
- MD5 0d680cb2c843d0d2045c07ce88cfa728
- SHA1 c5b185ba274c592c2f1d74c19df1d5c11c57972a
- SHA512 f20c74cf7d28dce4e22b1d984d3dcd6fde104ff33fb113b88344ad6e92707576f3dcb01114270ad7ee6cf040e5b47fa04b4a86fa98515ba7b96e38213a5d5612
- SSDEEP 12288:xXVPyT/qXSN2XHVIIQuhLusmbsfj28N1B2/92y1p4W7U31RuFfuhOZy48f1g:zP9SjIQym4C8Nf2Vp10FRQ4f1g
- TLSH
  T16125C2D51AB949A8D066C93C8A91CD8AF1EB7C0C173D36BB0274711C1F3EBE65A74E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  ProcessLasso.exe
- Size 1.5MB
- SHA256 d94bae802dadd4d930722680e4551a998fa71f6b90a0b33d6bf5f4ccbc596b14
- MD5 fba0fe5da22606ff64896e23160403ec
- SHA1 06f77cc8ea46d0bc845f2408346559c1d7ca41a5
- SHA512 04f2d0064441282ddafe65a5b5314f9d5e5496b92cc4c122fcc2e8eb9e5d53bb150740a54a4d46ef02cc554eea011a3781f6702db66188ef2ab38beef69b21e6
- SSDEEP 24576:50qYQ6K5/B0zo4n2oOQ77tAn6RlWU7yRhIrwJHIwOtY+Sfh+rpWRUfx:59Pl5/qzoNQ7ZAn6RsU7yRLJHtuYVh+P
- TLSH
  T16E6517D516A984A8E066C87C8981CD8AE5EB7C0C5B3D3AF70638B91C1F3FBD25674E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  ProcessLassoLauncher.exe
- Size 373KB
- SHA256 539d27a5bcd315a79053e591b0f0e77a4f1c59fbcaa0ca674187fba8d259a7cb
- MD5 520180513091bb9e028896c4b46b8d2e
- SHA1 d786a770740569985539190e31f9d78439c16313
- SHA512 f59e25b0b94e17ce5d95c34f7fa658ad28179338ddf629c009019b81b7b6eb849dd11d5295b723513593c75ca6c57c2f6fde68de869411fdf751b5a4cad091d8
- SSDEEP 3072:+95QMmsFwBcS8LQ9N03BFdfV7k+OlF/AoRk7HoZFWKZfTxmqg:0Muf7KYFdfbGRFW8fAq
- TLSH
  T13F844DD51ABA8DACD061CE7C8AC1CCC9A6CF6E1C953D363A4278341C5F7CBDA58A4D24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  QuickUpgrade.exe
- Size 613KB
- SHA256 a2d9cd450722a99620bb83ddeea0f7df1cc3ab460af0eba81dc67d355d8718f0
- MD5 fbb2285f31d64a30ccad3de3556c8da2
- SHA1 748b0bd5ecc3a1f437a628d05930d04692b46be7
- SHA512 1d4fd8e5a2f0055810ba1f91671df29d1fc62d0692f89e4e561216631598d4152d37ba3584d3ea25a02e59d897081a6300e73b88ca318a36cab584a7ba93f5a1
- SSDEEP 6144:rRySnbyEJz8vyZxrhP/pClvhwmPkx8GtTv+vEqykxk9QoVHdHkpszbULFW8fl65x:lySyFsCVhwmPyvT2EAp8b648flEf
- TLSH
  T1BAD4B3D59AB98CACD062DD7C8A91CCCAE1EF6D0C563D763B0278311C2F3E7965864E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral23 behavioral24
- Target
  ThreadRacer.exe
- Size 664KB
- SHA256 761831a0ceeba7a71ef9c0d00c267bbf70847b61b6b92c0f523f8830df3ef54a
- MD5 d38277f391422f8688aba67b099066aa
- SHA1 54cf4faea4ca45bbd115e74bf3dd60e53b75d2ab
- SHA512 af8ba144fd32bdd8d981bdfce575d9c22c26d3b41afbc724e959adc918af3a6e96c18d4d5244971f70672c4093c92fd3e7d009d507091ee649971535a4772f0e
- SSDEEP 6144:6UwMxeHuI+Npq9uZxAwSO3sY1Gf7CwGHMlLMuh0JrYmj+Vb8m2n+p1zFW8focZ:e2kuInysWGphtMu7m2bMq1z48foK
- TLSH
  T1C1E4C3D59AB98CACD062DD7C8A92CCCAE1EF6D0C463D767B0278712C1F3E7951864E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TweakScheduler.exe
- Size 571KB
- SHA256 23efcc109f58d27a29472c2e933b4a39220e7d3eb6032750176c31411fe77a00
- MD5 456d1af84e0441b333f18114a5c7ec30
- SHA1 05ea29c30429ae5bc7db5e11576990fb75ba8ac6
- SHA512 4f0a246de68869f0e53c9f2bdd82cf26735da06b4081be11024f457f84511fff8dcef12350b1ed194a33a9f2bde14ea6e6d762750854962bfa978ab157764fe8
- SSDEEP 6144:1AxrPPgrOnNzOH+o7LYZGCdfhwZ0oVAr+0hALSabAFakK1ZdZk:7rOnIH57WGwqZ0hLhALSJFBWk
- TLSH
  T13EC48C8677A443F9E17BC239C9524A56EAB278055724E78F03A843BB1F133A15E3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bcleaner.exe
- Size 374KB
- SHA256 8c4eae09b85cc33a330a69b77ae9dd8b6c8349e580cbd64a477011635c08cd6a
- MD5 7892a8a9d33b0c8197d97747dd99a236
- SHA1 92f72e96fe5becc256860cb70c5088b15065e7df
- SHA512 b6daeb84641f81f9bc57b9b84ab4eb201b47eedb718bfe2cc4906726fdb65342688caa375b6ac6adecad99b3ee3d7d4e30a4f88575651e70cab09e0d12807425
- SSDEEP 6144:qjguN98ykuZx7OyReyXf8f4Oz853Tq9vDXY6W2krGApBFRPRDluG61:8/9xkzyv8fnimYvtCD
- TLSH
  T19E848D8AFB6448F5E5639138C9A2854BE7B278591B70D78F22A4435E3F332A15D3E730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bitsumms.exe
- Size 288KB
- SHA256 64b88535e36feaaeaa2ca6f2fc528d53b91fa0120d67f3cfe0f08df0d9d1b81b
- MD5 2e3a06a6df0c719a53fb11beaa3609df
- SHA1 e9953a96a36835cab98de2835267163a8215a5ae
- SHA512 40845303f82205d4bc6ed66bfcdbc6568b5328cd417169ba2ea1e912be63e0318b4921b674384b123075e62cce6672b14e34f3d249b798fb27749246b2a03f65
- SSDEEP 3072:+p1qiHA7MvKBO0e0gqFvUUV4nFObBVPoH3v9uGqgmbDkyefNp3UloY46uMGIdsMT:+48yjvUUmnFOb/PTfNRohkFMMA
- TLSH
  T1D1548D59B7A50CF5EC73823DC8468606E672B8460775C6EF13E0476B6F236E09D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32