a3a5579b1b54c03fb5301cad3d68731d3ab4620f6bcb0ba2585ae5823b4187c7

Sharing

Copy URL Twitter E-mail

General

Target
Rainmeter-4.5.26.exe
Size 2.5MB
Sample260626-mgl9msaw2s
SHA256 a3a5579b1b54c03fb5301cad3d68731d3ab4620f6bcb0ba2585ae5823b4187c7
MD5 8403395486dfa997f2e7f14502aa9bb1
SHA1 5217395879ffd108f94f5ccd2127f58dc574a384
SHA512 4a11cead1627f82dcc512e4c5c2d538f5209fef1c9cabfe10e34d0d451eee70cf7b4cfce4d0c6ac5c420223a51d59178633e50f8d2ab05a2e27c9dfa80ec1b84
SSDEEP 49152:LclWLl3pggmVC+1m+4EFC0T5/9ZwP1Xo3pc/V3MaoYNMwJrQh3wdKh1wzei6lDm:LclWLlBF+4h0dMXo32eKjJQh3+zZN
TLSH
T1ABC53392A344C507EEA28F36793887275DB5FC1C28A0F35B7B90317AFA7B5028D19D46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Rainmeter-4.5.26.exe
- Size 2.5MB
- SHA256 a3a5579b1b54c03fb5301cad3d68731d3ab4620f6bcb0ba2585ae5823b4187c7
- MD5 8403395486dfa997f2e7f14502aa9bb1
- SHA1 5217395879ffd108f94f5ccd2127f58dc574a384
- SHA512 4a11cead1627f82dcc512e4c5c2d538f5209fef1c9cabfe10e34d0d451eee70cf7b4cfce4d0c6ac5c420223a51d59178633e50f8d2ab05a2e27c9dfa80ec1b84
- SSDEEP 49152:LclWLl3pggmVC+1m+4EFC0T5/9ZwP1Xo3pc/V3MaoYNMwJrQh3wdKh1wzei6lDm:LclWLlBF+4h0dMXo32eKjJQh3+zZN
- TLSH
  T1ABC53392A344C507EEA28F36793887275DB5FC1C28A0F35B7B90317AFA7B5028D19D46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
- MD5 5e2fd68a1ce97cc2866becb699fdb4c0
- SHA1 55469bdaea8e9660f69f15107affda81de2787ae
- SHA512 de94531b4f0d85bfb8de5a30390631dca84064e48f1984b7521d54382ddd26e3d886738455a4ed7fcba3f7ee8b092cf01cadcb8c3326b9fa5721e6d952db871e
- SSDEEP 48:S46+/DTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mW2ofjLl:zpuPbO5tCZBVEAWyMEFv2CmuL
- TLSH
  T14BC19370B3D248B9D591413778AB33D36612EE746784504FDB6315AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/MoreInfo.dll
- Size 7KB
- SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- MD5 bd393029cc49b415b6c9aeb8a4936516
- SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
- TLSH
  T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Plugins/ActionTimer.dll
- Size 137KB
- SHA256 14b76978dbd98d083c895f193397e429eb20770faf14750efd68f6fdbb3e9e68
- MD5 16324b99a82a9ac0da744d0b25e93c78
- SHA1 ebe6cee174985c490faf3e17c616320a55d02e1d
- SHA512 e0baa0d9b1b6c68da21a1f45287de27fd53cd9caa00a3d24ea853bfa1250707938f081486946bfa01de752f5ba44086ccd3c420a865b1a21b30f241c273a3dd3
- SSDEEP 3072:yjqnvTiwlmT6RQALq5QvOOh9P1tj5fFpYCmmKRIuBnKyrYGCTod:jR/dOOhHtj5YChkN4MYGMo
- TLSH
  T1B8D35B11FD82D033D6AF4C3198669AA18F7D7C908FF4A9D76B440EFA4A306D09B34B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Plugins/AdvancedCPU.dll
- Size 108KB
- SHA256 235c4dee0bd6d790cfa20f787077d876c31454a481eefd5c9dac85277a7956ef
- MD5 833a675fd08356789b475de64b5915e7
- SHA1 651d560fd15d56cad1b59aca81d2c160be59bd12
- SHA512 e7a23813ff23eec22bcedfc84276b0d27c5377fe8b80c1f5186958b7403e10c72a4b580a3d09d28a8c602cd6fcaa0d75020115f3abaa75ec41d8ccd87466a709
- SSDEEP 3072:fU4wIeze7/hnsGb20LIAlS8jF+1dGQFspJtUqWLCxGOdm:QK7ZsGKixj81dRaxQOxGOQ
- TLSH
  T158B36C42B5D08471E9BE59391868DE714A3FB8505FE09DDB379802BE4F343C1AA35B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Plugins/AudioLevel.dll
- Size 193KB
- SHA256 d5d8e94b73c9df6633627916fb1f563c8af647d2ce7b62e193df331212337e8b
- MD5 e76d957c746ceae3e2ee5b40d864c1d8
- SHA1 5eb0b265c20974fb07d1f05198ef6940158cd29e
- SHA512 0c954f070c0dc90a7b652b669c751d11f5dce8d295b0ab5b891f1b598f7070ecad50418682d56259c1c92ce96ed51c718c29ee8749439f563d92fa5d97e9fa80
- SSDEEP 3072:7/6J9nL0sAg0Fucq1sqq52rAbn5gXKoIhr/MoHKzrkd4V4uq3G0Kkmhv7dnH:M0sAOb2xIrAbnqaVMEKXkd4VBKjJWDl
- TLSH
  T188148C01F8D3D433D6BE193018659A668E3D79608FF098FF6BA40DEA4E307D0AB75616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Plugins/CoreTemp.dll
- Size 132KB
- SHA256 f3ecce1a407a36fda4b7b1511a597ffb5ea1b0a4504ee0261702ef22a58d5553
- MD5 14d733fe741d3c486c7c218f8b62b849
- SHA1 e26de003e24e30a19e09f3e201ca1a166b7f6749
- SHA512 80eb88c803e2b399622bf8d6ce8a09b4e0998aa6358bb2c763e7d8908455f8e277e152db9b17eee4bacad22e4ac80889dc2258138c444be7d5ea6ed3154f1e9b
- SSDEEP 3072:zCoPUNe4YrCQmDjfAiVZycNxAG9YSe84dVcGvdL:zrUNsCQijAiVQcN+0LBQcGv1
- TLSH
  T151D38D01B5C1C432D4BE5C381864CA764B7E79605FE0ADDB37941AB9AF302D0A735BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Plugins/FileView.dll
- Size 192KB
- SHA256 873fdf440481fa1f849b8bcd5ad6e2512674dbb953531701ca9bd05992aa07e8
- MD5 17d261b33f9ffb50f883ce99372b157d
- SHA1 08fff52ef9c27cc413db8c623d0b5c7f091083bc
- SHA512 fa4a0107c9f656be6f8ffc5e246ba36db4bee9dc55f99ba6054fca9423a4922d8b40d701c1e97b021f1f9f4421c0ec51445d554b0599109ac7862b4ae99b741f
- SSDEEP 3072:XrzBUyKBk2MkH4D/XUjQdZkvy/r/dwIk0Mkt/BsKlmVpVHUf/Wy2uHCND3TFZ4R7:SX9HwXUjPYrXKuHCNW2wSaJvVMKGj5o
- TLSH
  T122148E11B452D037E6AE0A705876DFB16E7DAD614BF464DB7B800CBA8E307C06B79B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Plugins/FolderInfo.dll
- Size 140KB
- SHA256 01687f916c6a8b563cceb46d5782e26c2993da1c11359f58e5d72f00e054e419
- MD5 ffb87bd2e27351f0aa218b7fabe793e3
- SHA1 cddbdbb2616615362cf0407a760902161358cdcd
- SHA512 2468633b34fbbfc8692973c2cda87e888b5db543bc3dd32d639b566b57434a62b4fc1b62da4b84a2829baea2d09e434d18aee696c58c057a6e1871245993e73e
- SSDEEP 3072:deyI44twGZjZdHRMHbGg3j64yn+puGQ8JsLaCukIEdZX:JIDZFpRI7T64C+puRGqa0IEX
- TLSH
  T167E37D01F992D033D6AE5C355966DA618F7D7CA08FE0A8CB67801DFA4E306D09B38B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Plugins/InputText.dll
- Size 35KB
- SHA256 ff42d1376a0b88941793d228b8ab5f80761c75454dedee493622e7664125a96e
- MD5 d61fa6e31b570b8e066405befd031922
- SHA1 93edf9261a0723ae583656b207945dd54dea0bee
- SHA512 f962b7cfa7ba4206ebfab2e0fab9243727caf0e8db98cd5d986906d4bc11bd85a1d040207826c1bf75223404ce5983b07f928455f25aecf369860b6f1edccc6a
- SSDEEP 768:NYPXbl0kFDyYbyrYUlx9hslP7TfsTjFR15ALZr:q2jY2slDT0fFgr
- TLSH
  T1CCF26C027BE8DD13DD9E8EB8D0E11A821BB1F3965C52D38B0F8490D963633916781B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Plugins/PerfMon.dll
- Size 104KB
- SHA256 aef22d27e183741adfe9e09beed22789b28a7f8819b5c8f5b3a11f8ef6e16210
- MD5 aa067d199dd64111eb2b640748dc2ab0
- SHA1 2953e05b7ca4a422e46a14305a3e5dfd9e1ebeae
- SHA512 ca66f56e16c7e9eaa6032e44a866c9dc9b57e01a59bb048a86af01c8e802114f0167286258f34b97982bb20e8b5aa7c6ef554bad990ee5610d8539c38ef7bc07
- SSDEEP 3072:sK6xthz3zFuWx3Ux6Hc5D6HWg+c5eXLiuGCsd:2B3Bkx6Hcd6HxdwXWuGt
- TLSH
  T142A36B5276D08072D9BE593C5964DA718A3F79505FF09DEB278402BD5F303C0AB39A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Plugins/PingPlugin.dll
- Size 101KB
- SHA256 87ccbcf875db12e8a0dd45de11e3136f8ef7e062f60f781ff0e1adf940f33604
- MD5 651d888e166651a33d3572491a2f0673
- SHA1 2b09a43c601e43150e53b8f9ea351b2a94efd91c
- SHA512 436b1968ae08cc96392fcfbf6295bc74e6924ed3fa2efdc78d79bc91bc2f156b31600cf6ff0203fa4c58ec61ebe5ae625efa1f52635e35a628f7659cd48c22db
- SSDEEP 1536:OxYgneAsWXrcdwmS+OnktqmyeQQIz9kYUHcOIe2NhY79gu/bAmxBE7ioFwfFT:gYLwmSUqmdM9ucO0q9gu/XE7ioudT
- TLSH
  T151A36B01B6D18471E9BE49391868CB615A3F7A605FE0EDEB2764027E0E703C1DB35E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32