0a95bb0f4a05b4c53201f5c4d723863174ba67ad1aa203f757d4e6ac9ffe7262

Sharing

Copy URL Twitter E-mail

General

Target
BeamNG-DRIVE-0.3-setup.exe
Size 225.4MB
Sample260710-lapwhsgx4m
SHA256 0a95bb0f4a05b4c53201f5c4d723863174ba67ad1aa203f757d4e6ac9ffe7262
MD5 b591a465d22c4301a92517bfb4a4e4a8
SHA1 1e13d33ceaef1a28967b051387801306e0bf6e9a
SHA512 ff2bda32f65b212a78797805b315066d34943f1e908b48852ab6072c6c3e1ce5940c1b937d1e16308be3aa9a641c44bf4dd8d46bbc3d24c340b86575efa9c3e9
SSDEEP 6291456:eDqLEKo70rJZqoPL6yHn9LPiL7iw1d7D6Q4PhPN66Vo0qHK:ZboMJZ/629L6iwfEN6nq
TLSH
T1E3B83323E65D78F8F6F923B21CE7AE067D779324EA4039221F714EE0686F40917B4649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BeamNG-DRIVE-0.3-setup.exe
- Size 225.4MB
- SHA256 0a95bb0f4a05b4c53201f5c4d723863174ba67ad1aa203f757d4e6ac9ffe7262
- MD5 b591a465d22c4301a92517bfb4a4e4a8
- SHA1 1e13d33ceaef1a28967b051387801306e0bf6e9a
- SHA512 ff2bda32f65b212a78797805b315066d34943f1e908b48852ab6072c6c3e1ce5940c1b937d1e16308be3aa9a641c44bf4dd8d46bbc3d24c340b86575efa9c3e9
- SSDEEP 6291456:eDqLEKo70rJZqoPL6yHn9LPiL7iw1d7D6Q4PhPN66Vo0qHK:ZboMJZ/629L6iwfEN6nq
- TLSH
  T1E3B83323E65D78F8F6F923B21CE7AE067D779324EA4039221F714EE0686F40917B4649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  BeamNGSandbox.x86.bat
- Size 243B
- SHA256 09e0928eaef7778a06196e6cdd7051bd92f9636ed4a7fa47340436f21a9844c3
- MD5 d9e2c24cd7479b1023d103a30653eca5
- SHA1 53566fea2771ede8c685280b2fa0ed651fde807a
- SHA512 742c870a5f3982050ba893517ac88b3c02c40b067c839b44fb90837aea5c61ef74ed50857917bc6fddbc774343d4cc8edd5b188786a40fde8a9f0e401f08c337
- TLSH
  T197D0C722A4C72435A471D61557659D173412DBC2A04CF2F03541537467955E9BE5144C
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral2
- Target
  BeamNGSandbox.x86.dll
- Size 14.7MB
- SHA256 cef81d2ae4168c777028151be9536cda418e6718d72f9f924b4f79bdbce467c7
- MD5 794397960ae4c478fd163bf647046a2d
- SHA1 48b0aa1cb5c6c0fd54e0c8d1fa05450a1baa4ef2
- SHA512 531be9535888aa568e49c07abfde63f362ef4c7ca0e00cba4426303329def5f8e811afd19a4a6bb212f983fcdbfe2b3a5dde17dc3c3e725688f7ded3d3aba4b8
- SSDEEP 196608:+MdUnUITVX/umuO1mMRB3YAroVIZ37yf+0:PdyvRuO1bRPZ30+0
- TLSH
  T137F6AE10BB6181B0D68E22BC349D771FD63EE6981B2447C387E8399E5DA12D05E772CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  BeamNGSandbox.x86.exe
- Size 132KB
- SHA256 170b1b2faa9881dc7ede71404bc02d0e77632b56c3404b90daf5fa430693b4f9
- MD5 e920a5527ede8c48200c00ec8664c617
- SHA1 8a0961f992be911d8b9accbfe15f7fa3a6870759
- SHA512 75f673ff119a1db344b7702241e24072904d73d3ae7874448fb4acddb96b2e02704f06c8e6f93f447aca66701d45d0b5809a3ab1e041b5b7982d7e4f6f4ae2ef
- SSDEEP 3072:N20an0fcwoxlIvgp0z+GayK/O/tUnYtUnYu:N2J0fcw82gp5otmYtmZ
- TLSH
  T178D33A1073D4C032D11325768A66C7F24A7A3C79BA66AD8F7FD22EBA3F39281D114719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral4
- Target
  CrashRpt1402.dll
- Size 123KB
- SHA256 8ab60ef632bcd02a2741380945a8d38dec25577b687a7162db0d255f4a78b829
- MD5 0ee90a075eb8adb82222c9b0dc2b55e4
- SHA1 fe25d225a32714d2b5d346e7ba0528f1c1db4c53
- SHA512 199157264c5cf8281581f2667c2a97071eb321718552b69b3ffb62b9858261123abc82f2eb3726cf0c3b6dedfe0b118016b1a39ec9d97beeb7044d5fa021b17f
- SSDEEP 3072:rx3of7DGAgAZAZsBIeyi3dQPv1I0OicCCnuOffejN:rx3oXeAZAZKIeh3c8KOffEN
- TLSH
  T1EDC3280136E2943AD5770F36487D568AE3BA7A705AB1810B23480E267F36553DFA23F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  CrashSender1402.exe
- Size 973KB
- SHA256 07da4de6b46856159b4810b075e010e3fbb30de3f31e8d2e71f512e6dc439c41
- MD5 25b0c8aee8cec0c7e2506918fd5835fa
- SHA1 4deb5766f02df2e9909bca45c9965448c2e6af03
- SHA512 d75aba472ed805357dbc951b5cdd1a1118177aa92c76a8cfb3e505b2bd53427e17603000ae53fedefb3c6d6795fa0bcc7ea17fdea30a690389d3282804ea7c3b
- SSDEEP 24576:WLVct94MeKtZ7XArEYqAvA1HIyDOJrI7CT47RIc:Wx5KtZ0HzaIykIeT6
- TLSH
  T187258E20FA829137F9F241B4C77D9B3B18387B35172695C771C829AC68706E2AE74397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  cleanup.bat
- Size 1KB
- SHA256 a3f23e006179a0ca0441a1ceee99a4198ea0007be58c80b67d84dd84e3ebd4bd
- MD5 00a0dcca06e16ce7409a0ecb12214783
- SHA1 ed75efa5f8ec345b5a0b63470d50cc53fa4ff34f
- SHA512 a710e083a94768b07438f4b8ef8a249ce0e402679738c11aad65168db107dad86f0732cc019c69fbfacad2e5766f155a34effcb14b14b62a9eb2ca5eee70a440
- TLSH
  T1F331DB7B1EC5037D110616EED7B449135D5EB1C50D2268A18CB193D8B74A7F8E40E9D7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7
- Target
  core/art/gui/console.gui
- Size 5KB
- SHA256 5a4242634d98f079efb6391b3fd546856e77223826a22e4f79946f02691073bc
- MD5 281585ee58ee8db0b14dfe36956d009e
- SHA1 cae6e2e9f7aca2fc192508fd53cae7e8ac0d8b38
- SHA512 80a081e0522da0477fb31ecbb75e51d3eb66e182c2748f3fa3632ca7b9a9823b531194c77249ebc606519497ba05ef7466910e84fcc2cf161df1fedd3609c7e0
- SSDEEP 96:7LsX+Y5OwImOtQhgtQhPCrAKRSiagOf1N1/R8zN/:Q7IBN/laxPH8zN/
- TLSH
  T176C1D07B7C89667148FBE3297FA71005FA6C1C5B1242E618759D828C0FB0825E6F0EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  core/scripts/server/levelInfo.cs
- Size 3KB
- SHA256 746131c0353cfa13bd5347a31747393b54336be63ec848b033be50812d162367
- MD5 9d4f3291c21969aa2321ee641a586c66
- SHA1 eca6fb39eeebc8c1953acaf6862fb145ea49def1
- SHA512 7e2871533fbc7ad52d3cb8f30d516d69e5b6d61cb1d833511d9ee9b54a3896e1cd61408ebd92fc8204fa99c83477c17d882fe5e5eace35f46765a0916f82bfb4
- TLSH
  T1358143187D8183F6205AE3645B396048E775A2A67B13D2C874AED18C5A34619C3FFDF2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  dbghelp.dll
- Size 1.0MB
- SHA256 9a26ffaffb26fa6549c6da75f76238a903ca723f9dad356fba8d91067fe312fd
- MD5 5c5e3afd499e5146fef1da5ef8a23205
- SHA1 8245691416e509a3a1bd8e321aa6d2ff1925a224
- SHA512 595eb2a4928092a64224077a3fee0dc80a58cb12cf174bf648efe381f81846f345f1f1556cfd90026715ae4fd5c7913eeb46cc7df08f97118a76c58422e7d0dc
- SSDEEP 24576:MA/j0DVD9vQYvfPlhPbZA28wtdzswxeqWiZUC82OLmoQKXIzrWNz:iVDZQYvfPlhPbZ97tdKeUC/OLmoQs
- TLSH
  T194352B2092408179CCEB31F5526D713966ACEAF2131161C723CD4FF9EB667E06E3869B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  dxwebsetup.exe
- Size 285KB
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH
  T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral11
- Target
  getD3DXVer.exe
- Size 6KB
- SHA256 bfb8a9ed45acd1d0ef3dd8932401ca06c856ed648e44d05bd2e9ba91d1ba6dcc
- MD5 1b3b1c4b75f2ea95e8827ed0e07dd1f3
- SHA1 a24d629a097d0fbf27d5185fe8847a2b1e911b11
- SHA512 ad08783b843b0e98312ad68a237296c2f2cfc857cd611a1baf2979f1ff911d0256f0dcdc54be048390994410537349238a9c76e00688abfc62f5dee796733345
- SSDEEP 96:14wa7rt2Rhf/rKKvd2QDug0q8+FBEIFBMlzruVABG66DCtb:1G7rwR9F0q8+YIIlzruVQG66a
- TLSH
  T140D1E80FBE49C433E3CD09F01D32D050EBA965B317C200F77AA326EA8BD99D194A161B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  tools/base/menuBar/menuBuilder.ed.cs
- Size 8KB
- SHA256 5f12377739143aa77d71dc317507ecdd0f5b666ce96dc6300a0fc09558e34205
- MD5 27eef5b2a57b2559a017c7d999763307
- SHA1 f0789868708a7e97e41cc31a7f8ef463c4b12538
- SHA512 f0439cd20b73f07ac6c3435f040c32541c90c7b391e2859717e130c5e5e2b656ce763a27347f704767a405b3d4f834cef4c9ca4f3038ac8718229fb53ca69b4d
- SSDEEP 96:qEsWQH3orkf1Z9EESpPFr2eHOKD8sU3ucGcu0CQ+54QLVTSo02:PQH3t6/zPHOKKAcY7ZS32
- TLSH
  T1530254353E866B7305AAF220479C1626F7245515EB2B974434BCB2CD3BB900949FF8BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  tools/forestEditor/forestEditorGui.cs
- Size 13KB
- SHA256 f51160c8bc8eafbdf9449fe9a336dd087e449fe9207d55ed47b08166a80ef64c
- MD5 2bac501600cf11aa01067b2a50cae336
- SHA1 9f157d29c1edb81cb94d1480a3e87446adf92eef
- SHA512 863c063cffb328a4ceecf6aa8af8d7b46bfe2a63139952ea0696966a1d698a0b4ce9e3b8943948355955afbe523823f4f54d59a234029f3ee651f8358454599e
- SSDEEP 192:PQH3j72CguYlVY5bZgQE7fYCi9oIjCk5ovwmayb9y8rQNoTmoxOZeHVtJ7I0IOLV:P+oM4aheZDLuQKCDaG
- TLSH
  T17852F0B92E0656F541FBEB3427DB0011DB3450B76F12CA28BA8ED6C05F754140BBEE6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14