General
- Target BlobBUDDY_Setup_2.0.0.623.exe
- Size 48.5MB
- Sample260727-pnlb2aen6z
- SHA256 f37876835ad9c15f888540055754391192c88c00c47c47ce5e12bc21f3f23e27
Malware Config
Targets
-
- Target BlobBUDDY_Setup_2.0.0.623.exe
- Size 48.5MB
- SHA256 f37876835ad9c15f888540055754391192c88c00c47c47ce5e12bc21f3f23e27
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 bedcdb63f027107c471fe244554c3038fb4caf9f96f7eab2d430f76f2f4f768b
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
Score3/10 -
- Target 98ME/dotnetfx.exe
- Size 22.4MB
- SHA256 46693d9b74d12454d117cc61ff2e9481cabb100b4d74eb5367d3cf88b89a0e71
Score3/10 -
- Target AxInterop.AgentObjects.dll
- Size 32KB
- SHA256 13a04e9f7de60c24b728f1c2fa23db77217c8a3fbb8cce8b2264df2eeb8fc9eb
Score1/10 -
- Target BlobBuddy.exe
- Size 4.9MB
- SHA256 16d05bda0f0baa29c14e93026a729259e565bd200bd58239058e610a5a3191e4
Score3/10 -
- Target Interop.AgentObjects.dll
- Size 56KB
- SHA256 cb15722b28cc90a2daed886bec0d88249da29e1973116bbd5c194e9f20399bf3
Score1/10 -
- Target Interop.AgentServerObjects.dll
- Size 28KB
- SHA256 39d9fdf29ed140491a23989e81cfff9b3c00d70f7ae5e0a945ecdbd28c29c25e
Score1/10 -
- Target Runtimes/Manual/CheckRuntimes.bat
- Size 279B
- SHA256 8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
- Target Runtimes/Manual/MSAGENT.EXE
- Size 391KB
- SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Runtimes/Manual/actcnc.exe
- Size 6.0MB
- SHA256 b4694750c1151663750e131ffd9b989a3b81818059b6d60dc279ecac966644e1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Runtimes/Manual/spchapi.EXE
- Size 827KB
- SHA256 7b05a46c786c91492d154683259c229aa9456286f688da18d4016d91625bebcc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Runtimes/Manual/spchcpl.exe
- Size 927KB
- SHA256 57858127f1a07233ccb4713bd29c860c9a7a201f2b8207ccfc91410478cce4b4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target Runtimes/Manual/tv_enua.exe
- Size 997KB
- SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1