2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f

General

Target
wnetwatcher_setup.exe
Size 568KB
Sample260628-ecby4se13j
SHA256 2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f
MD5 e9c4b160ad57a8957ae59dc4caabc875
SHA1 9f62b2b91d842c3bdd69f749c09242a62ee9ab73
SHA512 2e400a5d538f81e8383ecf3f8fd7497271416604d3d44b62ffa4ce492f4c9415194894daea09e85282dd3c452c4d7453bcd694ded56e974972837a31201d76ad
SSDEEP 12288:USw+OQBxGNZPjv7XLVSVLXs1cGMreMwcbnvXYJ0buziVWqpEA:USw+OQfGnUnsHUvXYzzvA
TLSH
T13AC4235B61C4D437CA2A0D718E7FC3FB92DBEA402D5C4A971F965E367C122C16A068D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  wnetwatcher_setup.exe
- Size 568KB
- SHA256 2bc68f8823a76fae8ff360cbfcae2bcef7863305e0b700201ac7c0ea7c79f52f
- MD5 e9c4b160ad57a8957ae59dc4caabc875
- SHA1 9f62b2b91d842c3bdd69f749c09242a62ee9ab73
- SHA512 2e400a5d538f81e8383ecf3f8fd7497271416604d3d44b62ffa4ce492f4c9415194894daea09e85282dd3c452c4d7453bcd694ded56e974972837a31201d76ad
- SSDEEP 12288:USw+OQBxGNZPjv7XLVSVLXs1cGMreMwcbnvXYJ0buziVWqpEA:USw+OQfGnUnsHUvXYzzvA
- TLSH
  T13AC4235B61C4D437CA2A0D718E7FC3FB92DBEA402D5C4A971F965E367C122C16A068D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
- MD5 3809b1424d53ccb427c88cabab8b5f94
- SHA1 bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
- SHA512 626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
- SSDEEP 192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO
- TLSH
  T13D523A51778888F3E792053EB45237079F9D5226B8929ED1CA331FC22D2B19E2FB1302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 ac53840d019b746ab5dabaa40d7720c9a4487c861b155926454bf8b10bd0963d
- MD5 8262fbc2a172ff04146e7587649d7091
- SHA1 628be3fede2a79d4b321b12f979711caf77e8a7e
- SHA512 8e11f1f1811a424b1ae5ab8e064d5313adc118ee7607f6a6f9b9976647ca6c91496133d5575d4737386a1485f39cf6fd074dbfd619807f42fe148a640186f639
- SSDEEP 96:Z+rBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tXGhEl5VN:Z+FepxPE1r8/FtmCDtWg5v
- TLSH
  T1F0E1F87AF7C044F3D68B43702863BB17EB669A211725B163992716CAB5C24E3DC34722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  WNetWatcher.chm
- Size 27KB
- SHA256 4582303cdbf8ef07579c19c567a6ba04c7620aa35ecf553cd4489773681aba81
- MD5 e02a94baeb4e86951a2b2f7ee4c01d92
- SHA1 f02836bd7417f60d2e0c08520fd1248e014c4f74
- SHA512 2ef906b791b025b431b01ca804e6f923f6deeac71f5c49d505afaef685424cb2d6dc799c6b7c27d8e021c32ecf437a608bbb05c6173add79002a10ae43685e51
- SSDEEP 384:bTgVEyiIlEiDkPecxDq9Sc2JoTylMQbGZ6fjLdeGbp8rwHbN4c427b+:bTg4CFDkGqDq9BTyl7deGar0b9Li
- TLSH
  T1FAC2D040E4222613CA97067FE9D3BD49AB2CAC43BD646053C69B97AE7E0D30516729DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WNetWatcher.exe
- Size 488KB
- SHA256 3295f058f7eb0ae972d078530a3003d48ca4df16f2538a73bce9497d0f688bf9
- MD5 17b08e40b85747d64ab474f0667cc155
- SHA1 5c8bfc69ff7b238b3dd82328b150df55b8514202
- SHA512 e7b86a9c49159f6cf87b98931fa9b164a6559d414cbbf9833139239e8d42674d94ec6f1941d83d3c0ed4b1a8c2015b5df399ce8bccf780f5759b5155369a19b3
- SSDEEP 12288:DcD2VMa5qhDdEatGK8byytcVvhbFeruEwpf:OyMa56Eatobyytwhb4rlwpf
- TLSH
  T178B423547E5D1592DAA946339880721D9034CF34BCBB97A2F01ECDBA3E0F3A84751BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5
- Target
  uninst.exe
- Size 46KB
- SHA256 cb20c7ff0d519038030763ceebac9136133ee69996c91055abd4db4239aef3b5
- MD5 ec7e613f8291ab0e8fb65a0985e0f491
- SHA1 89dad54132ec4d7e24a1648d2fe6839fd333c05f
- SHA512 39812fedf5a8b221128090c845ea736155df86c22aeefd623832b7e10d1282b59bc4358ca6b8395965676eb2b34cf823291025938014e51d18bbf6da1c64c57b
- SSDEEP 768:s/UpAHiGjRQ1kkjH918xnyzOp7OssT1pF/O71mJ/6gd2iZQAm6kRRS+NoJRneYwy:QUeHiWRgkkjH8nyWmJygdLeAyNxO
- TLSH
  T10923AE0A36C0C8B7D5AA067119B7CBBBF7FAF70116100A675B504FBF6921283EE15297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Nirsoft tools

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

UPX packed file

Detected Nirsoft tools

UPX packed file

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6