General
- Target AllusionPortable.1.12.0-ruc.exe
- Size 73.7MB
- Sample260702-ch2evahv6j
- SHA256 d89b6129f08707ef22e0ff174938b6bdbb8b8d64fe396d1fad6e3a3bb1db7d91
Malware Config
Targets
-
- Target AllusionPortable.1.12.0-ruc.exe
- Size 73.7MB
- SHA256 d89b6129f08707ef22e0ff174938b6bdbb8b8d64fe396d1fad6e3a3bb1db7d91
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target Allusion.exe
- Size 147.1MB
- SHA256 724665b3df9bb73fa74f799dd9d7a870fc3ab8b139b946bc61113b9e1a9d11c2
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target LICENSES.chromium.html
- Size 6.3MB
- SHA256 652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 800f4dfe8174883439b1f0f359f8eb4c0313ce993d79295de727c111b164183d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libEGL.dll
- Size 464KB
- SHA256 fe32775c207888994a4c51f47214a78c5b04908a2d4ed4f2407e1c1af54c1cb9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libGLESv2.dll
- Size 7.0MB
- SHA256 6e92c3133e37baedccfd6681e4e2ee3b1d8469a43a15322decbf7f453172b09b
Score1/10 -
- Target locales/de.pak
- Size 367KB
- SHA256 8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/resources/exiftool/exiftool.exe
- Size 8.6MB
- SHA256 d2b62e6e64032f3355a5f8a75c6ccadf6e92dad98e592a769fd953bc1a2d35d0
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target vk_swiftshader.dll
- Size 4.8MB
- SHA256 cea8333a4a38cfaa0936e2c3e3edde95e0d8ba0a11ce3ce2148c2a7f73a647f5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vulkan-1.dll
- Size 858KB
- SHA256 5a686093ad1136594b54070ddd0ff679bd5f1b8a149e796655bb5216dcc36aa7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2