General
- Target 3cb9e0d74cb2ddba6a150fa6957dfb314b750903fc95415ce1e9b7824e0c50ed.cab
- Size 4.4MB
- Sample260622-mgdbqsaz8l
- SHA256 3cb9e0d74cb2ddba6a150fa6957dfb314b750903fc95415ce1e9b7824e0c50ed
Malware Config
Targets
-
- Target AudioCapture.dll
- Size 91KB
- SHA256 8af1dd14b521d96d711b0ec5e1651d961b5f0d6ac18fbee3ef66e065e9766f72
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Client32Provider.dll
- Size 86KB
- SHA256 b900bf832a0bd1ce38ce3a8a2a13fea523f898f06ee34f1464016bacf5f3e94d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target CryptPak.dll
- Size 187KB
- SHA256 7e6616f762ab9f9850090d1c89507d2851222cfa1ff66982f84ac214c6fde570
Score3/10 -
- Target HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
Score3/10 -
- Target IPBR32.DLL
- Size 187KB
- SHA256 46aab21e20c6d2b2bef9baf26ea746186f5a5894cae04a2c0ed56160ef6874ee
Score3/10 -
- Target IPCTL32.DLL
- Size 154KB
- SHA256 e70cb83658b4fb9f7266ccf528219c835f0efbe5e06872d4f5fad8cd496b71f2
Score3/10 -
- Target IcoViewer.dll
- Size 221KB
- SHA256 434e7004f8be5eece4948c5fa71cb59c69d0e239e56946f2693b02475dd0c5bd
Score3/10 -
- Target KeyShowHook64.dll
- Size 50KB
- SHA256 7a4c95641766d8b2a6d9db292d48afa6e6da563cfad4ce33f74beb64470b6727
Score1/10 -
- Target MsInfo.exe
- Size 103KB
- SHA256 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
Score10/10-
Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
- Target NBBR32.DLL
- Size 182KB
- SHA256 80ee52d07ff8ccb745c6cb67b44523b6d38a3a3086a826c890080b79415f5124
Score3/10 -
- Target Nbctl32.dll
- Size 161KB
- SHA256 8ed968d09ae10f2aebc75d8b4d93e214ed3b38ff3af4e4f6ffbe52577c6bd281
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
Score3/10 -
- Target PCICL32.DLL
- Size 3.6MB
- SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
Score3/10 -
- Target PCIHOOKS.DLL
- Size 153KB
- SHA256 574eda2b8561364445e38f59ba93fb12210d07e1f80347bf67abb2a87e6891e9
Score3/10 -
- Target PCIIMAGE.DLL
- Size 551KB
- SHA256 c658f218ea1ab963a7afded167b0f4f5faaf97f5696bf4e1211cc0a4886e01ea
Score3/10 -
- Target PCIMON.DLL
- Size 114KB
- SHA256 47271356af5597a6704c654c5bc42a05a7cca9fde928b99f121ddc86bec71aa5
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1