General
- Target USB_Driver.rar
- Size 2.7MB
- Sample260727-fwthyahk7s
- SHA256 3f6a1c3a699545dd970dd10682a6038909d2fae7dd5d5887bfd584c10d3192fc
- MD5 bb9b83f1fb91945d2bb942b793e01bfe
- SHA1 3a0febe6975c510b7025e6fcce472726695980e0
- SHA512 871daefa684910d7e8890ec59f23e5ccb292ef915fbe3ae41e19b8ba3f489eac86ac75e7eb5865f707e1708dfd42facf12d6bf2885a8bfeed02dd47b3f24a776
- SSDEEP 49152:wLqyyERoYl9CViD34FXE4xWabpq55SEIZIoBvZy16istl1G/Qo+rjlwnU:wLWEmYl9CYD3wEFaUKJvZy167/1GAjj
- TLSH T1CDD533F4202562F3A9396D402B6F7D6BB5DB2DE32C5C0C905D9ECE863A92657B003C67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
USB_Driver.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
USB_Driver.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
imdiskinst.exe
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
imdiskinst.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target USB_Driver.exe
- Size 2.2MB
- SHA256 5b36d51d26b03635cfed731c501582a51cfca27aaf63f00cac505ee9390fb978
- MD5 b237868f000caa1e28c04be79895163f
- SHA1 36f79152a51b285e6444396e561db13b383293ea
- SHA512 1d127abb994671a81be390d4c2a38a83107c7b59e73fd38ca329061fc9a630d6adac8ec59b7376252fb47de6a68d49cfb53b9cd7d1a3aded14af87d0c1439787
- SSDEEP 49152:OZQSyIb/dRtfjrQIADqCnWRekSgCRUHZL7nYqd9ZG+S7igV+D9jPWyYAHZX:OZpLMI7ZRfT5nOdV+D9jMAHZX
- TLSH T14BB5334379B4101AF9C468B05C6341E72BA27C71E481B99DBA1D35DBAC7F212BF36583
- MD5 SHA1 SHA512 SSDEEP TLSH
Score4/10 -
- Target imdiskinst.exe
- Size 536KB
- SHA256 11d3423f3971b4d7a2bbda538e47998be901199546b36455315f22d3fc8b8a04
- MD5 faf8448e108d159b49638aba5e37f3c7
- SHA1 d6b064661f48336a7cac57ee4348cfac88b1a8bd
- SHA512 0a960f5d1507064ac02ebc478abe665d530b920e0adc0f5db23184e18073031d2e5bfe7287909bc9ecb752ce7614e7e19605eef2fc84ce8f7d1f142c884f88a0
- SSDEEP 12288:7jZGTE1zkAiqC6tKsOMNozQqO216P0unlbACUtL4SP:7jcY1zknVnEw80unlEsSP
- TLSH T13DC413527FE1C8F6EEC31E3198AE6F129975F5584B24A5F39302041E7D2A1D30E3A2D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Drops file in Drivers directory
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1