Overview

overview

7

Static

static

5

ماكرو....3.exe

windows10-2004-x64

3

ماكرو....3.exe

windows11-ltsc_2024-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

BugTrapU-x64.dll

windows10-2004-x64

1

BugTrapU-x64.dll

windows11-ltsc_2024-x64

1

XMouseButt...ol.exe

windows10-2004-x64

1

XMouseButt...ol.exe

windows11-ltsc_2024-x64

1

XMouseButtonHook.dll

windows10-2004-x64

1

XMouseButtonHook.dll

windows11-ltsc_2024-x64

1

uninstaller.exe

windows10-2004-x64

7

uninstaller.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

ماكرو...up.exe

windows10-2004-x64

6

ماكرو...up.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    cfd42feb7373030544be91d35fdf5431657db4348b71c3ee5269a9af9238915b
  • Size 5.7MB
  • Sample260712-e328zscy8j
  • SHA256 cfd42feb7373030544be91d35fdf5431657db4348b71c3ee5269a9af9238915b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstallerspywaretrojanupx

Malware Config

Targets

    • Target
      ماكرو vinko/1-XMouseButtonControlSetup.2.20.3.exe
    • Size 2.9MB
    • SHA256 f4707a78b51cbb82504db6cc2b3627d33a66beee7ea20d77472ae7e03d55ec39
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/ExecCmd.dll
    • Size 4KB
    • SHA256 1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/ShellExecAsUser.dll
    • Size 7KB
    • SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      BugTrapU-x64.dll
    • Size 364KB
    • SHA256 0ab8481b44e7d2f0d57b444689aef75b61024487a5cf188c2fc6b8de919b040a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      XMouseButtonControl.exe
    • Size 1.7MB
    • SHA256 ffad1bc9436e0462ba1bdd7cee9c2a57fe30c713de6b16d305eda6b55186bad5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    defense_evasionspywaretrojan
    behavioral15behavioral16
    • Target
      XMouseButtonHook.dll
    • Size 1.0MB
    • SHA256 1090fa6d4b30b5f44eb8890369bfc9f43b2b14835365d715441200ea5f48e9aa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      uninstaller.exe
    • Size 74KB
    • SHA256 b7c4b2721eaaca04055303864a419cc6cf8dec529ca02e66e117c6ac5ae64508
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryinstaller

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20
    • Target
      $PLUGINSDIR/ExecCmd.dll
    • Size 4KB
    • SHA256 1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      ماكرو vinko/AutoHotkey_2.0.11_setup.exe
    • Size 2.9MB
    • SHA256 510a833bdd0f896cc398eaae4ff475f5b7cfe37649efbf647b50d21e442394b9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryspywaretrojanupx

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25behavioral26

MITRE ATT&CK Enterprise v16

Tasks

static1

installerupx
Score
5/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

defense_evasionspywaretrojan
Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discoveryinstaller
Score
7/10

behavioral20

discoveryinstaller
Score
7/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

defense_evasiondiscoveryspywaretrojanupx
Score
6/10

behavioral26

defense_evasiondiscoveryspywaretrojanupx
Score
7/10