db2165746251c148ea431dc613322a734c1d366b1a3d1ba9943aed0925d2f65c

Sharing

Copy URL Twitter E-mail

General

Target
memreduct.zip
Size 17.6MB
Sample260720-al7d6act8z
SHA256 db2165746251c148ea431dc613322a734c1d366b1a3d1ba9943aed0925d2f65c
MD5 7f99380236ee7e237ef4b1f110baf0fa
SHA1 f75db595a9fb77b4acb7611ab681ead8d6ef6e88
SHA512 bf7e8b62c60d51b662aa5ef2bdf6fc112d38cd57770ee9178f161fa5e4262fef40e9f3fc0adb60ff24bf5a9873fec0120790f9968a739ad17d91dcdb9cbb6a32
SSDEEP 393216:3oDDt4dFlxSYRZTz0EGrhiKFMLqEWwGY2bQ6R500ka9Ex7P79AJEs:3GtQnzBQwGg69kgk79qEs
TLSH
T18517335A58409F89E06B71A31915465B0EFFE72F5104FF9293E48E3F8A43F2CE69211B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  _CommonRedist\PhysX\9.21.0713\PhysX3_x86.dll
- Size 961KB
- SHA256 08bcf2d63c82be6480f6cf781b638533d20177d24d17947f2b6d84e6034de10c
- MD5 2257ff6a75c304b95ca3fa63fca8ac97
- SHA1 bcc58c4c6122b69dc38561436afa58dc34b06a2f
- SHA512 36646cf3bb00a0c830ad40046291dc611be1171ca63afbd329ee2105a8455b5a68fc6d4d9042328d62882ccdd65e829c6c069845a58679b2d6acd66d6dfcce3a
- SSDEEP 12288:yuzddtX4JU2G1GwlmJuNIeXoAT1lkPc0pM5xWDIu1xiGc2p:ysT4JUZ4ymAieXrbkPy5xWDIubBL
- TLSH
  T1BF25F85032F4D926F2F31B703AB9E26159BA7E40AA34C24E3601565D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  _CommonRedist\PhysX\9.21.0713\PhysXCooking_x86.dll
- Size 1.5MB
- SHA256 4e1255dc8307456f20774ac07fccb8cd84af0724e8c6887337316ece8509e423
- MD5 4f96fa16e35d5f5af5a146f752ae3e93
- SHA1 f41c4c44bdff33089cc55df1b4ff5f57bab288e8
- SHA512 35b12254113f4bb727d21cf42537f0d0910c251577cfb39a77c49dca9ca904895d025d72386f3dcfd00e2a9ffe61441ca5e92fc55cb495ff5880aa51460b2362
- SSDEEP 24576:h/xJ+GisZsamUgG70xkoCnowiPZNeH0RxhbSC3/kVMzk4BPB8bTDXBDo2cREHxhw:PJ+GikmUgaUkaFPZNo0RPSCnzkvbTDXw
- TLSH
  T16F659D2272818172C8D321B430AEB337B5BE8173575066C793648BECFA646D1693B39F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  _CommonRedist\PhysX\9.21.0713\PhysXCore_x86.dll
- Size 4.8MB
- SHA256 828623b5e63913c2373a7f2cae89dbac67c09541f0562cad6c6f79abc4476d02
- MD5 09a0971b77c21a3de8cb462bf9547647
- SHA1 1faf8cce7964f4b05cd8c798eda6d3b121c0c0b4
- SHA512 84da47f16957990af5d306f2306aeb78f4a9cebe69627a9cfd5499b65551a595f01a6893535c221aaf501551ea1115069341edd42f286564a466ed0ad53a947b
- SSDEEP 98304:1sdekRbJjKCRx7RTdCO1Zh6uDffPhn7ZkEVpuZ/Ein714:mdZlJmax1ZCEbDfZZbUEi71
- TLSH
  T11236F15032F4D926F2F32B743AB9E26149BA7E409A34C24E3211565D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  _CommonRedist\PhysX\9.21.0713\PhysXLoader.dll
- Size 414KB
- SHA256 2d03fcda58c5562bfd947594e05670b06c4268cc7c0975e0088e00fd2963502d
- MD5 eebab1858827ccfef5daed9e7808f0b6
- SHA1 4f67cbb8f57afac2a87246763bcd865928f2f604
- SHA512 249e566c2565dcf8659aeadaf8bfcd07c6f952d52ae94040f2975cdd4e769dab7f15f46216c8d4d17a8f589487112ec735af8a1ab8bb5a18a3d6e57c4c28636e
- SSDEEP 6144:/5tZVgO7YopOEi0n/BZtPxYSI+TpwQG7uDA7M4TocCjCIs8VtVRuCbuklZ:rjgOU2RntPGx+A7uCM48cCjzLwkl
- TLSH
  T1F5944C6663D92135F3FB66743BFD9265887E79B02B21C0CF4390218A6870FC1A93576B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  _CommonRedist\audio\dsound.dll
- Size 448KB
- SHA256 8918ec37c61c3de55814af87e727fc61a04663ab7988913bec0bec7b8aa0ee4d
- MD5 697f282fcb8361a62c9d4b5a93a80780
- SHA1 4837e0d6288d97d10d4b729d59b8ab0cbc87f34b
- SHA512 fe9ed88294145dfa936ee590929ce0b97855c2623efa5b7c30a7b3a4fb842f29bfe436412bde02a968e10530408a302c7063c82e7a715ed8b669b060ad15f21c
- SSDEEP 12288:MIc+EkqTT7Hp7GTr0U+OGC/BzkUC0fBL+Yd5lnc9v:byHpSTBH5zEwc6jc9v
- TLSH
  T1BDA44AE0BEC495F0F8DB22B030FD3D3589AE98D15B6070C741D48BE6ADA41E15E7968B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  _CommonRedist\audio\winmm.dll
- Size 191KB
- SHA256 39721311959ad3bda7c554781d1833a22d9ac2dce1d15c5f5791336e6f394886
- MD5 426bdcd0d3d85c937ff8e5c5f114759f
- SHA1 6a49a9e6f772f3ddbad0a320572783f674fe730a
- SHA512 345537b101e178d9a8ce163c500c908321f941093c1961f1d92b7e8ff6ad96cad5c9741cdcf222aa019cfcfa3d25aa6a9f340b770a6515acdade651de58cf6ef
- SSDEEP 3072:gJ5lDSnMTguRR+6j06dI04LXvnE5svvEnM0qk8mfeBA4MwaaiW0qzisLEfZsa:IfNT/Rs6B14LXvE5JkaaiUu
- TLSH
  T163143C6226C8C972CAFB37710D7F7636557D98C84B9182C70AE02BF99835BC05D31B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  _CommonRedist\audio\xaudio2_util.dll
- Size 55KB
- SHA256 51038f0b7bd1be355917c6c7b83540d2a0c472d80e7a04c7ea10e437932bbf49
- MD5 499f8b2ed8d8253c6a6cbd8c9c9d2fde
- SHA1 bf9dc82b097540f2ab8e37b8053ba3570a434238
- SHA512 452e0c03ca5423c20a9da257f15b6618f16eac167c23c56924b6e185650d34b42e30dad56b4bbada4a0216a73d921e9f91d25d177446792bd6d37e915188ee26
- SSDEEP 1536:REyHcBjRXzQ1KmngsT24gTWmAUMnBZlsJ:REy8BjRDQj3gWqJ
- TLSH
  T1824312101B160B72F585767A068A4806B5FD11AE2FC0E9B7DD7F5981A480BCEDCDD71C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  _CommonRedist\runtime\api-ms-win-crt-math-l1-1-0.dll
- Size 21KB
- SHA256 f7240e3ed7d5ee552365d7c99896dce3c69d35568f94d3274e4eb6cafc47ffeb
- MD5 07112a8fbc224cbf1be36c6026c1670e
- SHA1 1ccbc4e0d41e0fd9f4650b6baeac036803b81d05
- SHA512 5d719a435925369303f86acb7fec2a1ede3672babc532d633fd2282d62f062b81d75c32f4ef8773895f515d7252a0fe7a22a76c1a26811489754f891e46b41d8
- SSDEEP 384:iwgP9Y5RbriqarNM+rEsK5/29tV4PPxfZjVP4AJWRvAL1ZnTxPU1pusesHuJj:iDV2I2QpR4PPTVP4AJWJ+16pux2S
- TLSH
  T13BA2E08C507693A3D37EF3B922F7B3EB3CC968ED018A49799C78053125462AD03B1E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  _CommonRedist\runtime\api-ms-win-crt-runtime-l1-1-0.dll
- Size 21KB
- SHA256 8539d598a7353263621aaecb4b1a93a12b75d6decc35473a96710c7a0261b9d6
- MD5 f32c381b9473a79f9b5dfaced23894e5
- SHA1 fa1fa0acb1ae31f664f0dc1ee6d17cc5b2fdcf48
- SHA512 ea1a3a0a84bba5b5f1976997ae4ef504b07b43accc93e4683513f822ae5da9b8e1288abe063938625b3004dde15c24b58d07c63fcf23ed2fe55bc495fa571399
- SSDEEP 384:hpwjkMrLC/KcFY6hdVZuiDGZFKaP5I1dGQ0dqm22DmZD7wx:nwZrG/6odVoXhGIhi2Dmp7wx
- TLSH
  T101A2E06949334425CFB0F3B502BA55A3D461D1B2BDA040E13304DF0DEABE9A07539AFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  _CommonRedist\runtime\msvcp_win.dll
- Size 257KB
- SHA256 918707d52ddee401e18f886e71c8496c7f553fd410e484776503e83355e55e55
- MD5 6d0437bccf3a01b57bda56c7f83d2e89
- SHA1 def818932eb6ae17075007825e722390987c4843
- SHA512 fec3cedb08fecdb6e326c52ed9b0d2a4a54597489de500d4b90b011e3090dae6c6a5a01caef5d5ee99d225367e01e49c20b3d3a75b5bfbdef9566798f07b9961
- SSDEEP 6144:V97Se4WkDmMzrwV2Btd4j+HkdWNW1OgQ36LqSzxbMKA8ZX42gwCyna3KEQk1g:QW03wVod4jutN6Q36LZzxAmI2gwCga3U
- TLSH
  T15F44232410EFBC1CED16F6B67D657A0639B12AE008BA932BC51FF34778447BEAD14805
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  _CommonRedist\runtime\msvcrt.dll
- Size 790KB
- SHA256 98492101ee18a2f693c03e5a75e77273d63205ab0707c63fc8983766e77633cb
- MD5 8895a4369dd82a99889d8e325d634275
- SHA1 af794a529d08f5cc83afda0df2b290d4ba603baf
- SHA512 50ac6a1ed6f1c9463e7f571a1501d348de316bea7f3daa3447fa7a418a09a6a05fc3f84a6837a92572b47745891a163492d8616d3e09d1ab2a926c58283ee29d
- SSDEEP 24576:IdXY/Y4E97FS85WBTX4bxZ/VgSpmdyT9r:gI3imXu/V7/r
- TLSH
  T1C3059D12F9D1C072C8B510B8069DAB72593FA5B1576490F37BD29FED98342D0EA3B31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  _CommonRedist\runtime\ucrtbase.dll
- Size 1.1MB
- SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
- MD5 c4a25dce665733663284750666684703
- SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
- SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
- SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
- TLSH
  T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  _CommonRedist\runtime\ucrtbase_ext.dll
- Size 4.8MB
- SHA256 140850a10d7436fc16368839bf02d7f8f7af0fb4dd20774997cb97e717130e3b
- MD5 f0ddc5ae4602d7f2e5544ea3f7253223
- SHA1 fc83a37ffdf54422c7161b69a32d529252194b81
- SHA512 12f15736cf324c9a120e6841d8e4a8b4c90c552d858bf001c7791a8f616a90c7adf2e015d4cc9b7e5e5a730e30ca27db8cdce36ba6f6bd0e3f7814b42ccc0da5
- SSDEEP 98304:341Wrk4DXwji+lEDUU/bdeiv9LajZ3NXz+pCIYdNyu8BnL:ooki3+2IU/b8PlKpCIYLN8B
- TLSH
  T10436F15032F4D925F2F32B703ABDE26149BA7E40AA34C64D2601665D1BF3B40B968F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  _CommonRedist\vcredist\2013\msvcp120.dll
- Size 444KB
- SHA256 0e535e147d253fc645ccb9406c888aee374ab1f3f9d99dc057a2b19cf401458b
- MD5 854fb5751985d6d40fa12bc9c3e82be5
- SHA1 e57cc61a59e88d2b6a373abca622af259c58be4e
- SHA512 03c9e9886f20249547193351750fc5bd8b5f32e354162ca9be04d8a65a701d73d2ad86ede9606a38ba6e030f2a9c02efc60d409411991bbb636340f1c258c32a
- SSDEEP 12288:UQHbDqy90l5yQBggQerjhUgiW6QR7t5ss3Ooc8DHkC2ehaxPe5:JbOqQbnrws3Ooc8DHkC2ehaxK
- TLSH
  T152A44B237B864CF1D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E223611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  _CommonRedist\vcredist\2013\msvcp120_atomic.dll
- Size 54KB
- SHA256 44adca787fe0a2a38cb0c318b94c05bdac45f265211e3508d568347d70d41dd6
- MD5 268da5c6c8871c7532592b513abccb79
- SHA1 305bf8117b1bf254748c206e587371d2dff316ca
- SHA512 6ce112341fdf060252d7476528e0fc5eb0270a24c54395d2888da96663c14bd43ff0ddba916f88edc347a4015d863cba0f4097859f3e180fbc3281aad2030036
- SSDEEP 768:3w0T+j14go/mvP1dvImjha/l1chhiJc7jheGLnm1HRtJ0FtKFHS0wwo8m:3wo+p8eldAmY7dJk9eGLnFnKF3wSm
- TLSH
  T10543F22332CD373BF1666C76E6C4971D5E301EC326BDCAB6BD0B487606762936261B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  _CommonRedist\vcredist\2013\msvcr120.dll
- Size 948KB
- SHA256 82225ec7e2da43a7a72a3d523698747512523afa488767ca6839c63a7a5706fa
- MD5 7dabb11da67d32c5dc917839fcbeb16d
- SHA1 198923794549bc37e8b05a326a403eedadba7b55
- SHA512 5e65b49ace7bffddeea1ad3c3aa777d6e23024b91b8bff3db1d1f4955d718d277e88428d671ce232807fc166818b891e8b0535b6aa4c21032dbc99840321fdd6
- SSDEEP 24576:UmFyjHVMxBuwQLYucGp4iiqgNb3HopbiKJ:iMy2yRgFopbh
- TLSH
  T19D25AE12B982C0B2C57602B1152DE77219BFB971443684B7ABD98F0E1DB46C0FB67B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  _CommonRedist\vcredist\2013\vcomp120.dll
- Size 117KB
- SHA256 11eefb5ae4d0b237ae08aabd46674fef76593af0992f48588174c5bb28dab053
- MD5 ea6734feacbdc80d6a6f91439c13708f
- SHA1 55e26baad07c7bf0557cc5f04e1a5a910cfefc5c
- SHA512 3a3344d3745f6c2986a32f482a0f5ccc0861ea2e44debe93436d44db7e6b4d94757ec07cac31eac38301163e2aa7a7f27a362ec6470320cb58f43231f70619fd
- SSDEEP 1536:4ysWjcd7xOCGRfXQFXqoRL47Ng2a+0zf5Ld/k1DG/LS+HDzVLE/LpL61vgbKoiKh:494RkqI47eLhLdwGbHDzVLE/tGvguxG
- TLSH
  T149C37C01B2F08035E0BB4939AA75A5225A7F7E735AF1D89B2F84455E0DB07C0EB35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  _CommonRedist\vcredist\2022\concrt140.dll
- Size 307KB
- SHA256 35f27db2c0d927136230467b7b89eec3f57f256e7e12d43c644d8b8074ad2c44
- MD5 2e2d83255acd40210761e76f4548c0b3
- SHA1 207ab3d0bf426ed9bb34d569573ddf3893ba414e
- SHA512 a0436f46de854677337d2370188cac5f7304cf6a66ea8c917ce1de615bfbdf7365deb0170d6a52c60b2df445b3d7b6f8f44cc2cdfc601a3416f2262f2f153239
- SSDEEP 6144:Cyna73EdGUtGzT6xi5NIg4iWoMGBFwrL4VppfRUUEw75sYgNAYLUNZb12z/VO1oe:va7A6Ig4iWoF0LIp/EjY0LGZQz/
- TLSH
  T19F646D70B50688B6F9CB1132D97CA76F906E5F4427A900D7D7D8EAED1D201D3AB32893
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  _CommonRedist\vcredist\2022\msvcp140.dll
- Size 604KB
- SHA256 6d7964bd08055935416349c0bcabf0484d76a11884a50546662a42e7e5697c01
- MD5 6f85adeaf89811312e54c6a518b54958
- SHA1 d819da91f8fe5983533dff97967d06b9ec1c6be6
- SHA512 fe390cbfea9a77cd8e9b3df79434b58383b3b7ea6e40d27cf6a7035f5889f0188dc8b0e214b3feff71f46573f13195c1703387bab89404a36ed39ed8cde6cea3
- SSDEEP 12288:4e2Oz78rF7Y5w6KESZTyT/4z17H+hUgiW6QR7t5s03Ooc8dHkC2esdxO8qUsJ:4Wz78rF7+NSZTyT/4z1T903Ooc8dHkCR
- TLSH
  T108D42A313A474BB5F48892F2655A276B9AB8AC17037091C392ADF9392F751CB17336C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  _CommonRedist\vcredist\2022\vccorlib140.dll
- Size 280KB
- SHA256 dba2723d66b474a7d094e769bed578855631014a447244f1f44dde1be2c16329
- MD5 ec1c005aa5cdc4c1364f8881d984a465
- SHA1 a083982cd8c5730b8a1abc18265f060a1f43ef64
- SHA512 340a7d08bb94608ed55d2917a60006b0d52e4948413804d6c6a844f8e7a2c59ae75f33867811bb926c1b4b5bffb11228d51e47f503f01998f0022cb908f82cb6
- SSDEEP 3072:0Uxekg8m/biT8GW/ZvS2bHwvxuLQ4ztOgnr/k8yGmpHzBzznJKTayNDGr1dE:iwmm4GWYgLQEtOgnzPmZ8mvE
- TLSH
  T1F6543A323E8CD8B6D6BF01358A949165546AB0920BE1D2C75FD4DBAD2CA83D06E3173F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  _CommonRedist\vcredist\2022\vccrt140.dll
- Size 4.8MB
- SHA256 5781093c3aa6e1fbc37b3e4dbfb64b0e61aa127922716de25d20760442921318
- MD5 a652a4d03b50fd627bee3adfc08d85c4
- SHA1 1289f6aec76ee536415d048de51151dbbb8b08b4
- SHA512 b33e2627b74fadf39ba315ca3be6dd6088592476244f9d36cc59b346fa1d832a4424726e9decca0c903a485e7074e3e2067ca47762ddfef8c1bb291babad65cb
- SSDEEP 98304:ejAOS0n8FWkJxIiU69/b+MJAoyDHy3O5H24NQ1hiZ59K1SH:cAG8B5L9pgyyuniZ59K1
- TLSH
  T1A736F15032F4D526F2F32B743ABDE26549BA7E40AA38C60D2601565D1BF3B40A96CF37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  _CommonRedist\vcredist\2022\vcruntime140.dll
- Size 120KB
- SHA256 3bb90465379e773e122870e4435966026550f46602586560269f952422f579bc
- MD5 40d3856e8a88f326f6648b31942eaf19
- SHA1 48207ff3ab0fd453a53f9de9dc5e32bf67659eb1
- SHA512 3d7a5ae951ac128b6162041b09eed25788af4bb584843c50864ae5affcbbb867e9364df92fe762d4a2950241a7f2e31e099b0b1e4a8c8e76e6a55f73240d8ebf
- SSDEEP 3072:iZG8PNVWuv2eeMesPUkWJ7vZxLUPLlqecbVGbaiz1X:ig8PNwuv2e3UkWZvbLUP4ecbV+a6R
- TLSH
  T1C8C38D507148C177D8EA90B491BFBA273C794A114BA047CB7FD49C949E38BE1BB3960B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  dsetup.dll
- Size 94KB
- SHA256 fe7e9d8b4509002e510dd04b155443b49f20d105c98f2cc4caf4ccca283d1fca
- MD5 1d996048beeae7b8472cf9b4e3601c4d
- SHA1 57fb122f56e5e585010bb515d54e74483c117ab2
- SHA512 1640f8d9a6221593ca8c2cde56e3d4b8519118ef158583ba7eae422e5d7fc3e26ae122011ce8e0d4f9060cd080467d5a3040383bc88425c45d3247d2647fd8ca
- SSDEEP 1536:bvAQNQAckKUCwdftm8B0fj75R/OmyLmNKRghHUbyVsML0cUIsWHgF2acdwVOIpPB:bVQAOUCiF+fz/OmTQghHUbupn7wVOIpl
- TLSH
  T139937B40B9D1C4B0D9BE4D3D0875DA655B3F7860EFA0ADEB278406BA0E302D1DF35A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks for any installed AV software in registry
behavioral23
- Target
  dsetup_orig.dll
- Size 93KB
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH
  T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral24
- Target
  memreduct-setup.exe
- Size 505KB
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH
  T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral25