8e13463aa73356382d7401aee3bb160fc070769321c8d17663d71fff783af0db

General

Target
Labyrinth_WIN.exe
Size 12.9MB
Sample260716-e1646acz4k
SHA256 8e13463aa73356382d7401aee3bb160fc070769321c8d17663d71fff783af0db
MD5 b435b45d8a1df8841af977c543f59b33
SHA1 7a72c231bf653cf8e5effd772c82615f60b5a014
SHA512 de2e1943ef9aadd285d28d260871ac4898d015937f95ad15ab4fcd195bb8b0e3e181b5c4bbfc538c32b072173078a9f8ea2f82398a1945cb5372fe99a29210cf
SSDEEP 393216:60OdVAZ5xMH3ixa9CAUcBhp3xdsSSoHLYoBc:64vg9LUcBhphGSrRc
TLSH
T17DD633966E964983FD21C13E59B8EEB7BB77EEC416BC060181ED3C97B52328018BC571
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Labyrinth_WIN.exe
- Size 12.9MB
- SHA256 8e13463aa73356382d7401aee3bb160fc070769321c8d17663d71fff783af0db
- MD5 b435b45d8a1df8841af977c543f59b33
- SHA1 7a72c231bf653cf8e5effd772c82615f60b5a014
- SHA512 de2e1943ef9aadd285d28d260871ac4898d015937f95ad15ab4fcd195bb8b0e3e181b5c4bbfc538c32b072173078a9f8ea2f82398a1945cb5372fe99a29210cf
- SSDEEP 393216:60OdVAZ5xMH3ixa9CAUcBhp3xdsSSoHLYoBc:64vg9LUcBhphGSrRc
- TLSH
  T17DD633966E964983FD21C13E59B8EEB7BB77EEC416BC060181ED3C97B52328018BC571
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/dxwebsetup.exe
- Size 285KB
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH
  T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral4
- Target
  D3DX9_43.dll
- Size 1.9MB
- SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- MD5 86e39e9161c3d930d93822f1563c280d
- SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
- SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
- TLSH
  T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Labrynth_24.exe
- Size 3.0MB
- SHA256 14d9567961fe5d95b24f35f17a23a8d587f8fb85707fe3f9c3c72eb82d7dac32
- MD5 b100c3c2d8394693509ee08a90892d0e
- SHA1 b56953b872ea3767311836c841cca4f0afe0ebd5
- SHA512 08dc1d7c2c5b51a6797153c0ae98ee0ff7979caaf77fdb82bcc4532696e8ec5df5b31d53ec508a76dffa8ddbcf6595431dbabd82f801a022715290a74f7d434d
- SSDEEP 49152:fXah6xXWi7vYtxYJnuEN1dKqt81yByouF4UhXAtG9MGTGD:ZWmvYt2RdKqtcyByouhhXAt+MtD
- TLSH
  T165E58E407281D0B1E44161F8AC5AE6EF46297F61872895EFB7D03F1A6A776E01EB33C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  uninstall.exe
- Size 56KB
- SHA256 621a64131ab2ca484f40c065b7ef905f1778359ae50ef566e4c308ecf2fdcd90
- MD5 e7907299e76829137cb7b31e48c2f859
- SHA1 ff12adcf30bd945447ebc94dd2aabd516eb64495
- SHA512 7feb68158e06283c95b2427dcc2d8468085437376ba639a9a814102cab5d2a5fa68249cd7417e427866d75bec7a86dda65f46174fd4c6d11bec0bd418f03900f
- SSDEEP 1536:ApgpHzb9dZVX9fHMvG0D3XJogVKKdGGGGGGNLeAyNnu5:WgXdZt9P6D3XJooGGGGGG1eAd5
- TLSH
  T10A43AE1736C289BBDAA606300DF7E7BEE7B6DEE4C9055A6357806F2F7CA1142CD00145
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Deletes itself
- Executes dropped EXE
behavioral7