General
- Target RegCureProSetup.exe
- Size 7.2MB
- Sample260629-pgsgrsc14x
- SHA256 7a670e163d640b5fa60ef6709270ff1e08325e63a5c33a87e40228aa3d0089f5
Malware Config
Targets
-
- Target RegCureProSetup.exe
- Size 7.2MB
- SHA256 7a670e163d640b5fa60ef6709270ff1e08325e63a5c33a87e40228aa3d0089f5
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $COMMONFILES/ParetoLogic/UUS3/LiteUnzip.dll
- Size 46KB
- SHA256 645fe3e7dc8ed3c2f363ee551f064986a10c36fdb9a37153b30ba5400cf738fe
Score3/10 -
- Target $COMMONFILES/ParetoLogic/UUS3/Pareto_Update3.exe
- Size 1.9MB
- SHA256 5a6f0e2fd369c09b22d29d7e6cacf247d7696a0ea3b78b88d58f5898457c3d70
Score3/10 -
- Target $COMMONFILES/ParetoLogic/UUS3/UUS3.dll
- Size 394KB
- SHA256 543c0f7cd418f055a98aab2645816278bd44fd8a60771003431489b205139a60
Score3/10 -
- Target $PLUGINSDIR/AdvSplash.dll
- Size 5KB
- SHA256 0990902460ec38bcd605b518bffa081942c6f4c5fe1828a61ba3965bbf15d8bd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/GraphicalInstaller.dll
- Size 38KB
- SHA256 7a72a7a6c28b9127d38cbdf14672ed1feaec86b72c83c0302cbcdbd03341da91
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/KillProcDLL.dll
- Size 36KB
- SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
Score3/10 -
- Target $PLUGINSDIR/Math.dll
- Size 153KB
- SHA256 4e540d1d8ca1c7564753232d18a884b0597fd7e5df88f8b5d370824d858954b7
Score3/10 -
- Target $PLUGINSDIR/SkinnedControls.dll
- Size 77KB
- SHA256 5f7998711ea856730139c4dac403f11b947ed94a464dc6d2d4b22f928c3a8536
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
Score3/10 -
- Target 7ZipDLL.dll
- Size 541KB
- SHA256 56c8ce7d1130a47db66b6371d8a73842cbae7b4f23c2531efaa18b513749cf4c
Score3/10 -
- Target CommonLoggingExtension.pxt
- Size 151KB
- SHA256 7bf1be5af48ccc3c713ad8e0c825da329f6f28c060f93b1d171dd042831d7c36
Score3/10 -
- Target CommonSpecialist.pxt
- Size 150KB
- SHA256 28d24d3e550fdd2085fc08f1cedc82eaaa119972e8f71a4cedeaf8a1328e2490
Score3/10 -
- Target ExtensionManager.dll
- Size 81KB
- SHA256 b19b8ad6b4f11482f14472e16e4db21475e0a3ea3d2911011ea20326190be4ec
Score3/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2