c6a20697e8141c3ef467d6ecf160597332e39f5b4ca270903107e51b250e5f09

Sharing

Copy URL Twitter E-mail

General

Target
processhacker-2.39-PORTABLE.zip
Size 3.4MB
Sample260727-arc3hatvbv
SHA256 c6a20697e8141c3ef467d6ecf160597332e39f5b4ca270903107e51b250e5f09
MD5 e662de5e157f73e67f9ec6a570227193
SHA1 5c4ce76a9b21ed0db87a0fc6b710d769cdacc464
SHA512 237ea20e772298edc0ae7b3332c25eaf6edee6cd45191fab773ea9b3bba88bee5a7ce25cbe89665643d3bacb1f7a231648d293aa5531a662bffd81caea7b48a9
SSDEEP 98304:zNFQ+OuVYp09CydhrAOU6qf7Gc7YGxQQPytWb9gNN:f2eYpACMpU6qy6YGmQP1b2N
TLSH
T14CF5333CA4EE592E50954B3DE0929AE35DD382A344B4D81B720A111488FF2D9FFD76BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  processhacker-2.39-PORTABLE/x64/ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
- MD5 b365af317ae730a67c936f21432b9c71
- SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
- SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
- TLSH
  T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion discovery spyware trojan
behavioral1 behavioral2
- Target
  processhacker-2.39-PORTABLE/x64/kprocesshacker.sys
- Size 44KB
- SHA256 70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4
- MD5 1b5c3c458e31bede55145d0644e88d75
- SHA1 a21c84c6bf2e21d69fa06daaf19b4cc34b589347
- SHA512 0d7abcc792127c37d6af58ec5b900c1754d02913794fcf37d92c400d3a9eb8981f6aa5515e48fa8fc11ac0eb51c1da260d7defc0e60b21de70a4e58413c296fb
- SSDEEP 768:ZkCOeX2Yg5KY6VgQqdzfVJdf/aEB2zBdZp0IfKg589z1hEn:nzn68BaIfRn
- TLSH
  T1C5134A42C7551CC6EEBBCE3965E89627FF30B8468730C2EB1215C0159F62BE2A978356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  processhacker-2.39-PORTABLE/x64/peview.exe
- Size 229KB
- SHA256 4259e53d48a3fed947f561ff04c7f94446bedd64c87f52400b2cb47a77666aaa
- MD5 dde1f44789cd50c1f034042d337deae3
- SHA1 e7e494bfadb3d6cd221f19498c030c3898d0ef73
- SHA512 33060b907c4bc2335328498aac832790f7bc43281788fa51f9226a254f2e4dbd0a73b230d54c2cde499b2f2e252b785a27c9159fc5067018425a9b9dbcdbedbc
- SSDEEP 3072:/U30KmLQQMpQZxRjsMUni4nuWKz+OHPKVgW9G0tpLmSlbJY/i:/UbmEQMp4TVtW0+Ovh
- TLSH
  T13F347D45B3E408F9E973C635C9618512DA737C161730DBAF036492699F33AD1AE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion
behavioral5 behavioral6
- Target
  processhacker-2.39-PORTABLE/x64/plugins/DotNetTools.dll
- Size 132KB
- SHA256 b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
- MD5 b16ce8ba8e7f0ee83ec1d49f2d0af0a7
- SHA1 cdf17a7beb537853fae6214d028754ce98e2e860
- SHA512 32de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb
- SSDEEP 3072:OkF+ncOyiGt9KQ130WlLJydacG3EkLLFjSeB:Oi+WH130U/
- TLSH
  T1E1D34B47B3E810ABE577CA7885A35A19DB713C661B71CB9F0354814A2F23BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  processhacker-2.39-PORTABLE/x64/plugins/ExtendedNotifications.dll
- Size 140KB
- SHA256 61e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
- MD5 be4dc4d2d1d05001ab0bb2bb8659bfad
- SHA1 c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
- SHA512 31389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf
- SSDEEP 3072:ucUs2pkSTVRC6//SZDTWeEd1D6gyqAnr6rw8N9TZof:ua2zRC6ncXWl4
- TLSH
  T12AE36C5B73E4046BE5B78639D8634A06DB7378250A70DB9F039482961F23791BE3AF31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  processhacker-2.39-PORTABLE/x64/plugins/ExtendedServices.dll
- Size 136KB
- SHA256 5ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
- MD5 4858bdb7731bf0b46b247a1f01f4a282
- SHA1 de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
- SHA512 41b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a
- SSDEEP 1536:cjYKbIeoRGwasSxZVqHa0fdZ5OiRJjHlcUhzD55DBdisWpZ9dl3K+OL/VfRc2:diLhZCdZ5bHHlcUz5PaNKxjVpc2
- TLSH
  T11FD3385763E905ABE5B24738C8734A15DB727C110B35CB9F0264C25E2F63B929E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  processhacker-2.39-PORTABLE/x64/plugins/ExtendedTools.dll
- Size 196KB
- SHA256 f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
- MD5 bc61e6fb02fbbfe16fb43cc9f4e949f1
- SHA1 307543fcef62c6f8c037e197703446fcb543424a
- SHA512 0bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6
- SSDEEP 3072:kahH9o/M+4BoraGA7sYt/zVcfg8Snh/3RFjxabZ67DG3p+DbR17LhY:P0MGraz/zRNh/3RU+72
- TLSH
  T116143A46A3E40056E977C678C9B34642F67338111B20DBDF066482BE5F37BD1BA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  processhacker-2.39-PORTABLE/x64/plugins/HardwareDevices.dll
- Size 180KB
- SHA256 acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
- MD5 a46c8bb886e0b9290e5dbc6ca524d61f
- SHA1 cfc1b93dc894b27477fc760dfcfb944cb849cb48
- SHA512 5a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73
- SSDEEP 3072:MTvTGn6NTm+vpcUVBrM9mG56i5O6wKPudbCWT08hQPpoM:M/G69bvucA56iA6EM
- TLSH
  T1C504095763E8006AF5BBCAB88A724506EB777C625B30DA5F0610912D5F33B82FD39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  processhacker-2.39-PORTABLE/x64/plugins/NetworkTools.dll
- Size 134KB
- SHA256 476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
- MD5 d6bed1d6fdbed480e32fdd2dd4c13352
- SHA1 544567d030a19e779629eed65d2334827dcda141
- SHA512 89362a7b675651f44649f0ea231f039e0b91aba9f84c91545f15e187c6cbd07bbf3648a4e232dfe5122cf5636e67c458f4f7dab49ed4de3f3a303aa396c41d1c
- SSDEEP 1536:mhhDibqaA8T+B++QWWEVGyEYfGup5oGjxNj8DsDdvsWch9dl/6RHyA8E0SHBZmA:ghGbA82+t6GLYfnoGjxp8e+ZB6RSALfr
- TLSH
  T1C0D36B17B3E4007BE5B68675D8A35A12D77378120B708B9F079486562F337A1AD3AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  processhacker-2.39-PORTABLE/x64/plugins/OnlineChecks.dll
- Size 222KB
- SHA256 7336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
- MD5 12c25fb356e51c3fd81d2d422a66be89
- SHA1 7cc763f8dc889a4ec463aaba38f6e6f65dbdbb8c
- SHA512 927d785d03c1ee44b5e784b35a09168978b652f37fb73a1a2eeecd3583c28595fb030e8c1f87ab9a20beac4622775777820d1a2ad7219ba8b9ae8b6fbc4568a0
- SSDEEP 3072:VDy7cjwTlCAlW0InMxf08ZyIjSNVnKJ3HzuoX7o+ThTPD0r7NF4jM9Td2xOdj+C9:Vu71TtInMxf08gI2HnKJDuG73JtxE
- TLSH
  T1B7246B54B2E50C78ED77C63AC9634542D6727C120764DB9F03A0425ADF2B7E1AA3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  processhacker-2.39-PORTABLE/x64/plugins/SbieSupport.dll
- Size 95KB
- SHA256 57c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
- MD5 37cbfa73883e7e361d3fa67c16d0f003
- SHA1 ffa24756cdc37dfd24dc97ba7a42d0399e59960a
- SHA512 6e0bfab9ff44f580f302cabd06fc537a9e24432effd94b50ab696b35f57a61772072b7f9045a9e99fa4bf3bc316f43ea25ab6c87517242e7957eb86575203bed
- SSDEEP 1536:Im0GxwvasFsbgkc+kvtRSmgDzxdXsWZr9dlnVrUv0ukc:Im0hasFs8H+kvtRovrTxVrUv0vc
- TLSH
  T1ACA35B69A3E500AAF5728A74C8635E15E776F8121721CFAF0294428D2F637D19E3EF31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  processhacker-2.39-PORTABLE/x64/plugins/ToolStatus.dll
- Size 243KB
- SHA256 5713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
- MD5 3788efff135f8b17a179d02334d505e6
- SHA1 d6c965ba09b626d7d157372756ea1ec52a43f6b7
- SHA512 215d6c3665323901d41ae5151908c4e084a04a1558617016f0788194304e066410b92943bd6c119339727037ee02cfda893b9baf5603b2870d9fc5ae0c77ca7e
- SSDEEP 3072:tOHhxKcNnCYBFNFAKIkpgVIgHAuopbQfhVV2aOQE6o0bp94wZOeb299zBw8:UHhrtaV3AuopMMeb21w8
- TLSH
  T133346C97B3A1089AD5668E75D4738A1287377C911E348B8F0698F52E3F773819C3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  processhacker-2.39-PORTABLE/x64/plugins/Updater.dll
- Size 110KB
- SHA256 0c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
- MD5 6976b57c6391f54dbd2828a45ca81100
- SHA1 a8c312a56ede6f4852c34c316c01080762aa5498
- SHA512 54d8b39457f516d921bb907615ff60a46b6031e1444a443c9657e06d78c9fb0f637ae4756bb7b884e4dca2f55902372ad4ddba1d020abe02e0a381702ae270cc
- SSDEEP 3072:yy8QoSuThifQ0gUmL1lV51hdJFxZ9l1JtB9plRN51hdJFtVpRR5hJt0rsBLsGbOd:ZiYQ5UmBNerF
- TLSH
  T129B34A5763E4006BE5778A75C8631E05DB76B8621A31CB9F0254818E2F63BD19E3AF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  processhacker-2.39-PORTABLE/x64/plugins/UserNotes.dll
- Size 114KB
- SHA256 fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
- MD5 e48c789c425f966f5e5ee3187934174f
- SHA1 96f85a86a56cbf55ebd547039eb1f8b0db9d9d8d
- SHA512 efdb42e4a1993ee6aa5c0c525bd58316d6c92fbc5cebbc3a66a26e2cf0c69fe68d19bc9313656ad1d38c4aef33131924684e226f88ef920e0e2cd607054a857c
- SSDEEP 1536:0fiz3P6ZDIigvpiwyXtHaGFKNQCf5FlvULnQDCdxNsW99dlhSkkOZ8DCuB8ViFw:3P6Z0iGNyd6Gi7f5/eQExdL1kY8DCurw
- TLSH
  T1BDB35A57A2A5007BE5B7D674C4A30E05EB7278611B309B9F036482892F637D1AD3EF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  processhacker-2.39-PORTABLE/x64/plugins/WindowExplorer.dll
- Size 133KB
- SHA256 282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
- MD5 0e8d04159c075f0048b89270d22d2dbb
- SHA1 d0fa2367d329909b6c9efcb3cc2c2902d8cf9b22
- SHA512 56440f3feddc124574debfe3789e14d908982d4d8e9516f42fab7db7bcecdd3badd2f75e005016a7b9d87a00d5646b8df722bae8fba3932198babbe5335cf197
- SSDEEP 3072:FrcYzsiPpE70C5FwyJBId/GkWXaVJ32kZ8:Frc0s502FFnS8
- TLSH
  T1DDD34963A2E4007BE4728A75C9A34E09D7B2BC511761CB5F0754825E2F637D2AE39F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  processhacker-2.39-PORTABLE/x86/ProcessHacker.exe
- Size 1.4MB
- SHA256 d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f
- MD5 68f9b52895f4d34e74112f3129b3b00d
- SHA1 c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e
- SHA512 1cd875f9d0301b14645ea608fe61560a229ee395fa061f32675c3d84e41916998f887278d8497a5e875be22ba8fcbcfcbd878a5e2ed1746dc75430b7aed5fede
- SSDEEP 24576:fsmjNvgp+pxECAucO9iWFT0z7rLuUhFP3MGX:PFgpAiIiWdzUz35X
- TLSH
  T1F9658DA0B1E78120EBF25D3255BA7B25A5793E1A0F3488CF6684787D18706D1EAFC353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion discovery spyware trojan
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32