32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e

General

Target
ChromeSetup.exe
Size 2.8MB
Sample260731-g2j25axtct
SHA256 32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e
MD5 5e8337608ddfcc8db454619639098501
SHA1 c7e5add4ba47088a6ebd3ac7c8c3cd3f619d4e6f
SHA512 2cf5c98db17a01d1f8fcaa59f590d66719ac3d200be536216a0640885df844e8492d51d9d291ec3bb636f607dc674585a3bd4e4e9298c2a9c4dc84d03e0dea5b
SSDEEP 49152:4oiPj+/yE64TV/PS1c4c/G/nIRDRGdLRcoknjz8BMi9ZEEdqRHp7AR3pY0+AAtNa:4owj6tzVH4c/GAbGdL72jzl2fccrYtA5
TLSH
T195D533709370569CDA014937A821BCF78784BD2BA407F82E17746D14772B3CA9A7AF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ChromeSetup.exe
- Size 2.8MB
- SHA256 32b222165a61978b9d981cbd77eee2c24d7d366021ad3abfcfcd052d7a6e8d4e
- MD5 5e8337608ddfcc8db454619639098501
- SHA1 c7e5add4ba47088a6ebd3ac7c8c3cd3f619d4e6f
- SHA512 2cf5c98db17a01d1f8fcaa59f590d66719ac3d200be536216a0640885df844e8492d51d9d291ec3bb636f607dc674585a3bd4e4e9298c2a9c4dc84d03e0dea5b
- SSDEEP 49152:4oiPj+/yE64TV/PS1c4c/G/nIRDRGdLRcoknjz8BMi9ZEEdqRHp7AR3pY0+AAtNa:4owj6tzVH4c/GAbGdL72jzl2fccrYtA5
- TLSH
  T195D533709370569CDA014937A821BCF78784BD2BA407F82E17746D14772B3CA9A7AF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 238KB
- SHA256 83005624a3c515e8e4454a416693ba0fbf384ff5ea0e1471f520dfae790d4ab7
- MD5 38f2b22967573a872426d05bdc1a1a70
- SHA1 ecae471eb4e515e1006fce645a82b70c8acda451
- SHA512 31bc78bb4efc7c178c2c489b77d890b8806073180fbdd58156907c187cb73b0860701a9a2648da1da4930a8934c9a86b60ea5550315afebe833a681bcb4368e0
- SSDEEP 3072:NFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:NFfYCaqoDfb6mxk2LqHXj3if/Pa
- TLSH
  T14834BF457EA8D80BE65402F87A71CFBA1669EC20AC61C103E7E1BE5F3D79B56BD01381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $TEMP/ChromeSetup.exe
- Size 10.3MB
- SHA256 9c0acb85737434d8d32093f3fe759e918ed1568170c7997e5716636f29ac0faf
- MD5 81bd237cc27cea43c1efcdd9262e94d1
- SHA1 d2e0244a2865f2a9b1b0b235a90a77e8164debd3
- SHA512 b700f28a5b588cde9aa2cc4216e436e30a8a16922a00228c0cc8456dd762f3cfa188a111397f7f30732069fc29a6f41a9d12f850aa871f0f671872d0df2e39d3
- SSDEEP 196608:swu+3J3kFkpdAfW1dsOyzHJzqeNIdn5fyNK1GEZ54wSn23h//GrjfKNOFgVN4W05:swu+ZJcfW1dsOyzHJzqemJ5fyE1Swg2e
- TLSH
  T14AB68D02F5A09034E4A73271B53D673E8D317E629B3686CF97846CD46FB46D1603A3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5