General
- Target meccha.rar
- Size 69.1MB
- Sample260701-ek2jqsfy71
- SHA256 e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1
Malware Config
Targets
-
- Target meccha.rar
- Size 69.1MB
- SHA256 e1b56b7c2f9a8f768616db5e861cb4bd323e8003d561e0ddd240a3914f1a7bb1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
- Target meccha/EOSSDK-Win64-Shipping.dll
- Size 8.2MB
- SHA256 b73f5e43ebf4579f17411ec26d3824adf4ff09636a4cef3cd0712c83f5eee70c
Score3/10 -
- Target meccha/EOSSDK-Win64-Shipping.of
- Size 18.5MB
- SHA256 9821beb84ed841d2e9bd412ad55b7982cf1fcb64edbf0fd3ef7ccac38632fff7
Score3/10 -
- Target meccha/OnlineFix.ini
- Size 648B
- SHA256 f3396767978d24f77e95b179dcc4afa073689a0d86b3e0491fde74e4ad355760
Score1/10 -
- Target meccha/OnlineFix64.dll
- Size 13.2MB
- SHA256 27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target meccha/PenguinHotel-Win64-Shipping.exe
- Size 167.1MB
- SHA256 8f6e26cfe9763dc8a467b642bf13d926373332e434e23fdca4d7f4a93f5cd6b7
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target meccha/PenguinHotel.exe
- Size 217KB
- SHA256 4584159e0ed79b5303e698e53948de6b804bfdf693c1805620b3e6d67aafdc09
Score1/10 -
- Target meccha/dlllist.txt
- Size 15B
- SHA256 fc0befb4aae4b7f0eeb1c398fccea03cc795590e09db6628974520091fcfc516
Score1/10 -
- Target meccha/winmm.dll
- Size 490KB
- SHA256 61d071e40fb1136da66bf12213062a47eccadd7556171b97381fbc937e978b0d
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1