Extracted

• • Target
    Drv_ceo_12.8.1.exe
  • Size 24.5MB
  • SHA256 5bdcf2d4fd8a65c17237d4808e2b613deb0f54de1b90839f1f8e450d8b2acc19
  • MD5 aa246c59edb665b82b92e0788a41337f
  • SHA1 1ebf85b32bffb858911ea65289cdbcf4ca3bc304
  • SHA512 60240f7af86efbcfd7acfe115b5485c20e283302d7be9de65b10118a2befe5d6c3357e356d01670bbe1b50e0ae68312aa5a1d090fdd9a7090c958553bdba2fd2
  • SSDEEP 393216:dLAmLbNyS3QBin05X2NXehAJ1q8pQ9bwXxxcyOQr2YUfg3Acdf65bThCfRYsWlul:9A+bP3dgX2NuGLQ8+y4kAciBC
  • TLSH
    T1C847338023F00398F473F770CEB24B67E6BA7858FA62D74D9681254F1E3A6519990F26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordonutloadervalleyrat_s2loaderpersistenceprivilege_escalationransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2