39e43feac4261552a6989b39f66fba2c5c8b9de21d1806199500acb69f7e563f

General

Target
NoRiskClient-Windows-setup.exe
Size 16.8MB
Sample260710-rlgl6sds6s
SHA256 39e43feac4261552a6989b39f66fba2c5c8b9de21d1806199500acb69f7e563f
MD5 6827a2fa7767364ecce4aeac4f91c66f
SHA1 e08ce7eb804ab3a15ba66fa9ce11491b30d1deb4
SHA512 c371dadbb38de06482821210987be001af7caac5f47ac9c1d4963d827a02307c9d69617fbe5ab2aab67aa971c7017c448106d390272f2ccfb25e198a70401035
SSDEEP 393216:udYmfp4O2fg+MZ90Y74IBqqI4So6YM2pRNLLPu3NWse6d6FGi9C8lzD:uWmfpfmg+jY8QnLbNLL23wFpZD
TLSH
T127073312AAD7C1E4CB03EA39E17F4BE37618D6AC49269F8E55F0CAC043287DADC1D564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NoRiskClient-Windows-setup.exe
- Size 16.8MB
- SHA256 39e43feac4261552a6989b39f66fba2c5c8b9de21d1806199500acb69f7e563f
- MD5 6827a2fa7767364ecce4aeac4f91c66f
- SHA1 e08ce7eb804ab3a15ba66fa9ce11491b30d1deb4
- SHA512 c371dadbb38de06482821210987be001af7caac5f47ac9c1d4963d827a02307c9d69617fbe5ab2aab67aa971c7017c448106d390272f2ccfb25e198a70401035
- SSDEEP 393216:udYmfp4O2fg+MZ90Y74IBqqI4So6YM2pRNLLPu3NWse6d6FGi9C8lzD:uWmfpfmg+jY8QnLbNLL23wFpZD
- TLSH
  T127073312AAD7C1E4CB03EA39E17F4BE37618D6AC49269F8E55F0CAC043287DADC1D564
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 19dc958d4aed6b0a5e2acf402c3f85ffd73cb38a46184bd8d25afb8bebb6a60d
- MD5 2a4dbedb7e8fcda02f2ca952f08f7392
- SHA1 212b1328605838f73753e855163f6828278e8116
- SHA512 2cca41e99369d52c67b6109274f8e60a423d435333bf781d2224a2bcc32cc8e786678b0612552cc97f585ee1674979d4313ca1a58de296339a98c0039d6b7b94
- SSDEEP 49152:NiiGK3juTGz9bFhdy5fXzNdjCzxDGL8YeC:0izYGz9bFhQPdjWSF
- TLSH
  T10075122575E08030F6B72A3099F599B21E3DBD715F71968B53821D2E2E30AD1D63A33B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2
- Target
  noriskclient-launcher-v3.exe
- Size 27.0MB
- SHA256 669b62a37e9923d569f6aaa01c1ada6a7c6c6779947f68733f0a324a26521cef
- MD5 8ca9a7238dfb4d00c91f3a5da704360a
- SHA1 5631672d41f17fc8673568e215296d882b72cef6
- SHA512 594744eefb5fd6974b5d111b17cf4ca69e673efad5af2e713c43ca74de5e30f80ad7be5bc7a82a4811722e0ff487e3af3e6b33a494f7922a48a9dbca23c1ff54
- SSDEEP 393216:F9WW+CgBObpvDrSyNXBcW3z6j/MOXxlgyxD:TcxBOdayZeW3z6jXXUk
- TLSH
  T10E57BE03F29181E8D09EC478835BEA37FB76BC894524B25F5BE45B212F29F50AB0D749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3