General
- Target ArgusMonitor_Setup.exe
- Size 14.6MB
- Sample260722-qsntdsstf1
- SHA256 fec06d1a20a1c6b99e9c5b90c2a7dbdaa801e1790391f81d0198bd3207a63059
Malware Config
Targets
-
- Target ArgusMonitor_Setup.exe
- Size 14.6MB
- SHA256 fec06d1a20a1c6b99e9c5b90c2a7dbdaa801e1790391f81d0198bd3207a63059
Score8/10-
Drops file in Drivers directory
-
Stops running service(s)
-
Adds Run key to start application
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/AMIH.dll
- Size 60KB
- SHA256 b19ef6d852a44abc9d555b0b1c2adb6a68a950188ead37f6fc7d6aa986706677
Score3/10 -
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
Score3/10 -
- Target $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10 -
- Target $_12_/ArgusMonitor.sys
- Size 79KB
- SHA256 66f8d6312ad7fccb3562e05a3a023655636757b5ee1753c779c5b34bc8af1b92
Score3/10 -
- Target AMBattery.dll
- Size 593KB
- SHA256 375f111e1aff6a4c38bedca2da3377ffd7073f85089e98545a98bfb722ae0047
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target ArgusControlService.exe
- Size 1.9MB
- SHA256 24e94d43ea32a94d038b7a18c12b442ca5dab7c6db9130be50c5c4b57e91cda3
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target ArgusMonitor.exe
- Size 5.5MB
- SHA256 edf365298ec3ba978b41c11ae3c1761727604a1ba636fcad6d56d8680d0c52a9
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target ArgusMonitorGadget.exe
- Size 3.1MB
- SHA256 9a7a0ed50f9b56bbc4a2b5ea3a425b804e687c197a31677b8c142941b08e2858
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target ArgusNetHandler.exe
- Size 1.7MB
- SHA256 f14ba5fe6f3b7b82092dc9ff1507f28844ff4a7690513564e62ef269fe4fc21e
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target ArgusSystemMgr.exe
- Size 89KB
- SHA256 e810f5fede4d87beef8a14186ccbe3005d7ae26148de0673c672afd04f35ad09
Score3/10 -
- Target AutoUpdater.exe
- Size 1.2MB
- SHA256 11e97ac02f37f1438277d18ca638613feeddb2a5a2c9f56cad59efb90aae94b9
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target GpuControl.exe
- Size 253KB
- SHA256 d71d921914e140e4ca70c4ae6986784c9b0c737e21f919e84be2a4a15deb2ad8
Score1/10 -
- Target HWInit64.dll
- Size 264KB
- SHA256 5de636071a56d515ab9920f5a5c7db49fceec5a9928a338f580c3cee8a373274
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target InstallDriver.exe
- Size 18KB
- SHA256 2a1c32b4ada624ee22e1f9d4d82d2dbe51e47e0cc62fe62831e98b6b3aef5452
Score3/10 -
- Target UninstallDriver.exe
- Size 17KB
- SHA256 0acb41b132837ea7a5c046ed7d10428bf6b51bebe5ac7e6ef047a41b385fa206
Score3/10 -
- Target libeay32.dll
- Size 1.3MB
- SHA256 f5da7f8fbf844d130f3fcb674d9ad09427b867cec7b956c730973c3f48b1e7a5
Score3/10 -
- Target libusb-1.0.dll
- Size 223KB
- SHA256 3f050dee9fbf995bfbed2f4969131877fcd1b59bfd3afd2a767ff6844e872430
Score1/10 -
- Target ssleay32.dll
- Size 329KB
- SHA256 8bdff8c4dd2d8b1690e4d63deb9ab4068a5109a0b78b64bf1e920f1696b0fb41
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1