c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27

General

Target
c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
Size 13.5MB
Sample260706-pygrlabs7l
SHA256 c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
MD5 0e554726e5b40d4e3a119fda106c4edf
SHA1 b2187f17d2d53018b7a6890b7f91a28d5a03a552
SHA512 1855c477bde3b831c9083faa44253374be37f597ea4ebdc797ab3369ebe12a6e225216e4713d171b5760f6d6d5cccf99c3fc8ed149958058afd2c4b33b929f6b
SSDEEP 393216:NDkb03mDhBeRWjU7g07L2yihG1SCeEP9Uk+kU:Sw3MBWWQD+dGiEdU
TLSH
T1B4E63375B2487176E76B79AF29223416F0706800D4A627E773EF6382817CDDAC61C29F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  memreduct/dsetup.dll
- Size 13.8MB
- SHA256 351feb2f629cc9b6c4da4f47a12aaa2dd5016b8fb609d6a574c706d45c166052
- MD5 8cdc0b22e85fc568f7d17c5139686c68
- SHA1 17b3b7be8299488b69e9f2d44a89d5a178415d7f
- SHA512 15d89cb4d98b2d4807097242460ac790ec1bf12324dd6c6a506ef7b60cce76f4fb966ddd9b004bfd55c4f51b9cf8da5851bb3cec0726b0597e1154a49aa20cee
- SSDEEP 393216:mDadaPKDNFQluRu70A35CqWN6ZGUaoPN2ameB:lcPgFuuIfQL64oNB
- TLSH
  T1EAE6235032F4E526F2F32B743AB9E22158BA7D40A534C64E2212565D1BF3B40E96CF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  memreduct/dsetup_orig.dll
- Size 93KB
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH
  T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  memreduct/memreduct-3.5.2-setup.exe
- Size 505KB
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH
  T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral5 behavioral6