2fbfe6761c98b332b4342353be2cef945d6a1e46bb5c7c406e6f0eb4c92db07d

Sharing

Copy URL Twitter E-mail

General

Target
MatroskaSplitter.exe
Size 1.3MB
Sample260723-j6p52sthjb
SHA256 2fbfe6761c98b332b4342353be2cef945d6a1e46bb5c7c406e6f0eb4c92db07d
MD5 922179eaa854a88681cfa278170073d7
SHA1 9f581cebf2339b23e5d323bc7657474d7d7c29be
SHA512 f80c7598a6334ad200b20a52ed7f4c82e25f71bd84ed7f7403f90388eeea1683453e67c0265b49cce001a567a8ca7aa0d281a36423617f99ac770b0374776c0d
SSDEEP 24576:yixIWakM991zN/gVGl9xYilx5pCu44Cnio1ycQwExp2ItclAS5ma:hxIr91z5gMtJD5p4Dnp1y2EPkrN
TLSH
T1525533016AD3D89DE620DE390B3A432FFEF1194207A74347E7B55DAA2670FE4D01E899
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  MatroskaSplitter.exe
- Size 1.3MB
- SHA256 2fbfe6761c98b332b4342353be2cef945d6a1e46bb5c7c406e6f0eb4c92db07d
- MD5 922179eaa854a88681cfa278170073d7
- SHA1 9f581cebf2339b23e5d323bc7657474d7d7c29be
- SHA512 f80c7598a6334ad200b20a52ed7f4c82e25f71bd84ed7f7403f90388eeea1683453e67c0265b49cce001a567a8ca7aa0d281a36423617f99ac770b0374776c0d
- SSDEEP 24576:yixIWakM991zN/gVGl9xYilx5pCu44Cnio1ycQwExp2ItclAS5ma:hxIr91z5gMtJD5p4Dnp1y2EPkrN
- TLSH
  T1525533016AD3D89DE620DE390B3A432FFEF1194207A74347E7B55DAA2670FE4D01E899
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH
  T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- MD5 a4173b381625f9f12aadb4e1cdaefdb8
- SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
- TLSH
  T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  avi.dll.new
- Size 107KB
- SHA256 89b5dac2f62c486274db592f6889fdfa633ac462d6a19653e34a5a6020dde1be
- MD5 6a37f50e0ecb0976c10a2726a6d2e009
- SHA1 9506488e652a2fd7527838610d0e28df234f0b2f
- SHA512 68357f206a258089d763f472ae91a1ede6f83ff08cf1bdf798e78e13f19e39f8961de2600b65df24443030a7c7f94ca8ccd80335adf1e0af0cbfddbe914007aa
- SSDEEP 1536:9/J7xpdNtU2hr7ogJGhG7QoyVczH39o/5IktGnNHDJlOiSKQzy:9JLd/hPpJG7oq6HtohV6DJIiDQzy
- TLSH
  T1A1B3AE2135D0C472C08B253D4171D7669BFFBA318AE4988BBB6816ADAF607C0973B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  avi.x64.dll.new
- Size 119KB
- SHA256 7084e8f74f1ec85360746b06e5e57905d5ac8c041bb6b2bad159d51c88f9c853
- MD5 703a8c287ca5a2efa150bfbf1b8e9273
- SHA1 1cf66e7743958eda5b023a5174b0b6ca16cf7419
- SHA512 115a46b5a9524730b164345087941d6c38e1a887284f7d37bc8d3fee034a784b46d949ffdb121bd46ff36fb360e599d56c434cd6a6455abb19686588972c3176
- SSDEEP 3072:u/uHF6MIPeL4/KPsnibiSuRGj88DhtQTXj:VHF6MIPek/KPsXLRCrOz
- TLSH
  T1BFC36D4B73A940BBD0A6917AC8535A5AF772B405036553CF47B8868E3F237E1AE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  avs.dll.new
- Size 95KB
- SHA256 5d9e306f5b65eee12f9b2bf9aca724660b9aeb49abda66033884f5af85f90f78
- MD5 2d14ae313b539649445d6da50ed4492f
- SHA1 fb42b95ebf6d5108de0841e59f857bdcd7ab72e8
- SHA512 3afc8402931ab2394c42eb8d515255306e4334c8569d289f0040b9c2f77cbcdc8f959e3518d395326c8bd4f66803ef8590f18ff9cac259f35dea6b941e4d0ec7
- SSDEEP 1536:TMjprUF0UxPP1VNgMrcaok6HpIO+AnDK4FgQ60e:Id4F08P1MicaSHpz+b4FgQ6
- TLSH
  T1D8A38C217181C1B1C89F693D0529D76057BF7631DAE4994B7F781ABE6F302909B3A30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  avss.dll.new
- Size 91KB
- SHA256 118a8b6567b19ad19f19f4217ba2edfa0448e267836e46429f4b8d2fa9086fd3
- MD5 94e696aa38b5e3ee57f7043d9be3efc9
- SHA1 d3950ecc37b25daf6aaf0a864484457714493281
- SHA512 747165715e60a9e5fee2994599fbad6d6a6f6db3a6914fb003f8bf8ad0acdd8a824a85e1846cedc7c7c66defb0c8dd836cb99e827082b994ab9db3585a2d8c17
- SSDEEP 1536:DHcgHV3cw1iFk/dGNkdhmzlBnJK+y7az8mQJyQM:DHcgH7QaXsQJyQ
- TLSH
  T1DA937D2233E1C072D09F65394119DBB16B7FB63197F58947BBA80B7E5F203909A3934A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  cue2xml.js
- Size 4KB
- SHA256 8bdcbc564b3042d2e62df71f8c705b88805d78170e8fdf064ee2127d090aa513
- MD5 7d471b3960fb58e738a44b8a82e2cef3
- SHA1 c6af13f95b37383de8099638814347ef25027b29
- SHA512 c5c19dc2479fc15ca73cde15b84a7586ab6e8346a6fd4090a5477e489ea36ea204b7a3dd7ea8a8f7c798a518c860eda51e0a753eef0abb6ec7e5d7bf3537664e
- SSDEEP 96:xfiHJmhLmiJIfblI5K4BGpgJUH2ywPU/UnU/GesfQFcdQJvoVvVHPCXt:xfiHJmhLmiJIf2zGpf2y+U/UnUOjyCQl
- TLSH
  T12EA1F954B876507235BF25BD2AFB2A4CBAAD91038400C625309CD8DCBFE5DD0425EEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  dsmux.exe.new
- Size 110KB
- SHA256 f8c0c4cb7908802bafdae561ae39fee36d84ac27a4c7ae0d650f0cb6bf1a2314
- MD5 a8411ec5384293b9559f5bdd763cd397
- SHA1 6f6cf7f6be6a9e148aae563a6401be3cf50a7aa2
- SHA512 7d141a2fd1d3b164469ee32db01d5407cbdf3bf2d40352c301a1a5b572b7c86a87aa89221c95f3b32c04d821d89b44a6e71ca518485ceba88d661ce55e37ae7b
- SSDEEP 1536:6ZOreouDiEjWY+psnjvGdXRs6c+R2Xtn7rWJgBGMswJStkLxRnyKMDkoWQb:n6oojL+q221kgBGtwJ1ZMQoWQb
- TLSH
  T16AB38C2236D0D032D49715349A28CBF42ABEF93246B9850B7BA41B7D5F707D0CB3A75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  dsmux.x64.exe.new
- Size 133KB
- SHA256 0fafd74f7c987b69f51fd03d2e5a904ab6bbafc9fbba7220a71fe8f71b64698d
- MD5 aebbd973d81c98eab112e126a61f1c34
- SHA1 ab309186e50209475d4b27a28fdb6712309ab86e
- SHA512 3a80208b31ce22ef2d958fe1cd3bf22db94ad7358a36b19b2134fa614607117842b7cade32b3bfdd9c7ed59390f1548103cd8b99663324ba1ca284936c586f8d
- SSDEEP 3072:61EW5VDeDAwN/7Eff8pzAVY2sSpisgUC3GaTm45QAPgd8e:61lsb/AffufSpisXQtTm41Pgdn
- TLSH
  T15BD36C5AB3A910F5C057C279CDA25799FBB2385B077543CF02A987A52F237A09E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  dxr.dll.new
- Size 244KB
- SHA256 19a53adfd455c0ca3d89522d7762c2c389b8698143fd1798cda218d2c916fe1b
- MD5 ef70b53cd6dcb98533fdcf3f0f4b2e59
- SHA1 c114793220a83d00e6696ba21c78d9a9a377cc48
- SHA512 927ddc14f4fca9a4f1a3f072dd2149188da61f7a0fb68db0a43818fa7a77668c5ceaf5a0ebb699f44b535d3a765e438ea93964af22a4fcd4bdc12408b61d429a
- SSDEEP 6144:EYCVTJWNPPC/OupE3tQto2YwU5qYyb4j:EfcPPC2upE3two2Yw
- TLSH
  T173349E1277E1D03AC6AB1131552793FA26FF76324AB9C007FB940F6E5F72680963870A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  dxr.x64.dll.new
- Size 324KB
- SHA256 874c257765b4528f85b7378a48ce53d97df94a0cd86982fa07f2bcac2428432b
- MD5 a8e2cae19f218d152407218f70e21132
- SHA1 3204cbf8d03a56b6869e18a86e28a74a95507a9a
- SHA512 2b24dbee635845649f10898c7f6727567443f21c8dc885fbf7aee32f547e4e11282576992a9503ede5695a1df75b76be8fe1977ee8cb2ce2ac70cbe7251deea1
- SSDEEP 6144:FaQuo4rtS4ILvp1ETkXuGdUxBIKa0/YMPqYCJUtoB7bu/yBAikF:2oUxKvp1GkX7yxBBgYikF
- TLSH
  T11A645A4AF7B448A6E123917DD967D74AE7B234450B64C3CB136087AA7F337D0993A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral25 behavioral26
- Target
  gdsmux.exe.new
- Size 349KB
- SHA256 97b74d05d50443e31a0de2f21e4ec2bf427d6e9c01f698ef31e0f244aa7b508e
- MD5 efeba7b08cc277a4011187dce1e0b823
- SHA1 0c7e36b88782930230aae86faf767c4dbc9e2475
- SHA512 1060b735b95cd6b1fd73e5f8295d756af4dbb5a370ee956d46fc346d5c13e5d1dce6835d29b5190342b52ac185a2d81fb319a249f0a42fb96f7143cffde2a0c7
- SSDEEP 6144:H5twGZHkzSZ3FlxNo68Yr6PLUP3rOy0szTJ/o:EeCSZ3FlxC68Q6PIP3rpz
- TLSH
  T1EC745B123BF1D136D1931231DF66D7EC6AAEAE221D208507779C3B2E9F706518939F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  gdsmux.x64.exe.new
- Size 469KB
- SHA256 1e46edd3909d6268500774fcd9079bf95542a9e69567849f79eca582669b805f
- MD5 e0f1e384d2a644bec77df32ef8760874
- SHA1 9d7ea591fe88adfc8bea2c5783c6c87200becbc0
- SHA512 bf88240ff6be48f22e06753edb1ce82d80a146ea3e400b17767c5458898711ad11fc3293a58ed9166deb7ca1106009085d8048f9919f0d7b3c504202e6116763
- SSDEEP 6144:pjGjVOJ+vKmxRfzo2JMPkad7FbY+WsQJa/jE1FIJ+b2/c8bdDJhx63kIIvrSNMJs:pjvJ+v37o2WPB7ma/kNibd9hgUfzYfz
- TLSH
  T135A41916FAB400A6E1569039CE53D6DAEA713C860F2087C7715DEB7A2F335B14E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  mkunicode.dll.new
- Size 24KB
- SHA256 0331fe01f1843f6116f735abb1675d9cf51e29970c9a6ec876a9440013862892
- MD5 3d46f41fed16db116dafab61458cfa24
- SHA1 bdd788e6e7d11291ecf0bcc159964e6c75a6e0ca
- SHA512 5468daf4e6064b2a61641730aaeec95c729ea8412a778b6d5897fd9212659632e90afabc06e9e4eee102fbff728ae4eb58103e9a1ac3f5223111c2a9bfca9453
- SSDEEP 384:duhAVJc5nTawOsIoy3qtiB9DRPnoDtaYCV6YxJde9UnV+gn3mj:doH5TaKy3qYnmaYrKV+H
- TLSH
  T124B23584A7F81989FAF75F346AB150958E37FE63BD72C49C5646120E0870A84CE78B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32