Overview

overview

6

Static

static

3

ARMClient....on.dll

windows10-2004-x64

1

ARMClient....on.dll

windows11-ltsc_2024-x64

1

ARMClient.Library.dll

windows10-2004-x64

1

ARMClient.Library.dll

windows11-ltsc_2024-x64

6

Autofac.dll

windows10-2004-x64

1

Autofac.dll

windows11-ltsc_2024-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows11-ltsc_2024-x64

1

System.IO....ns.dll

windows10-2004-x64

1

System.IO....ns.dll

windows11-ltsc_2024-x64

1

TheExecutor.exe

windows10-2004-x64

4

TheExecutor.exe

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    TheExecutor.zip
  • Size 1.2MB
  • Sample260627-eg14ssht4m
  • SHA256 4b1c123b2df2898f28a99bc68b82f81d558186dcd60aa5ff27cf29abc3d543b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Targets

    • Target
      ARMClient.Authentication.dll
    • Size 66KB
    • SHA256 9931b5d62e7fb38eeb8f86f6204b6055f7eeca08cba780698167c8846ca90647
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      ARMClient.Library.dll
    • Size 32KB
    • SHA256 90d4ca5ab2baf128d46a3f5d5a71bea524c413f40bdbc4a03668436bcfcce5f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      Autofac.dll
    • Size 203KB
    • SHA256 bd97d419c50d5773eb285d9b6040c4cf531b5d03790786e1e2c09a372ff34761
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      Newtonsoft.Json.dll
    • Size 531KB
    • SHA256 7b1bbdd36dfccf96d8b941782bc79a43072130989331242548c3553d5c8578ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      System.IO.Abstractions.dll
    • Size 53KB
    • SHA256 7da16ef846948a94f665b694b9b65e6882496dbb27ba57a17abfbb51f7cf07be
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      TheExecutor.exe
    • Size 305KB
    • SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral11behavioral12

MITRE ATT&CK Enterprise v16

Tasks