36bd5ca4aaedc3d7f377de097ba915eaf4774fb07cb080aec7e5359c7128c1a6

General

Target
ivcam.zip
Size 57.2MB
Sample260710-gs2ktaft21
SHA256 36bd5ca4aaedc3d7f377de097ba915eaf4774fb07cb080aec7e5359c7128c1a6
MD5 660630762cf338cf269b41c3b9335c5d
SHA1 d42090aca71e2381227f71e6361f7deb29c27835
SHA512 57119e4e92d92116f2fab733f184d4df208bb3b951e0faabf6b2854459c97ce8baa714ce7e50f123970102668222b85e9c0562b424e7a96b36e9a6ef2d2f004d
SSDEEP 1572864:oxNJGVoP05MiR29l33xQdsDvRLh3+OIa5gyGeolzeZAFOMehv:GPcoP05M199WGNhOOIugyKzeZAChv
TLSH
T1E9D73322745C52D92DAC0564E6079FEB66379B2703BCF11B3EDA1789FD875A38232E04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ivcam/dsetup.dll
- Size 57.6MB
- SHA256 b4d0f84e44a782b5c98c48a34a5442bde600f59e451a067f5ea28d3cbe528966
- MD5 7a8a4e95d3d586b050d51e9fed7f1315
- SHA1 aa2dd7567fc5df4ccde7fee6efc7669920451031
- SHA512 d8054b1bf89cb72660025396d0b63346509abebdcf84557381631d9cc9622678c562acb330bf753a88bbae127c53216bdfd17d943b6bec172602f590166b9be6
- SSDEEP 1572864:0nphedyp6W3/22dI1DdnBynqT9cFx1O0w0DMuuceTJGtdsIe:0XYyp6W3+2S1ZUqExA0w2MukJGt8
- TLSH
  T17AD7334232E8C075F1B20EB47A79D2E25D773E5126BCD14E2A21776D1AF3780A438F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  ivcam/dsetup_orig.dll
- Size 93KB
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH
  T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  ivcam/iVCam_x64_v7.4.0.exe
- Size 505KB
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH
  T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral5 behavioral6