bc6a214e9a72717c56e688833ac6a09a32a3015a694d01ca990cc348e8c1962a

Sharing

Copy URL Twitter E-mail

General

Target
bc6a214e9a72717c56e688833ac6a09a32a3015a694d01ca990cc348e8c1962a
Size 6.3MB
Sample260731-mteeka1cje
SHA256 bc6a214e9a72717c56e688833ac6a09a32a3015a694d01ca990cc348e8c1962a
MD5 95b0a74d8ebd3d74355137b65666c30b
SHA1 6b924a418634bd98eb990bee168fb7dc5743f9cd
SHA512 716eeca77757e5d5b633c44949862703623b747ac64671b62b54d3c33e77f8537dfc7a8a28c25064a168c6d99ab2ff4c3f0e014ef6f91e51d74f7684a7313a5e
SSDEEP 196608:IkYWklz2j3gokQvi4abbi4AR0fVnlR90EVKp2:Ik9qygZdfD9vVKQ
TLSH
T17C6633DCD5F8C1B4C27409F53D04AEE398A7EA7CA16891E92F36D0B7651AC0F903A563
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bc6a214e9a72717c56e688833ac6a09a32a3015a694d01ca990cc348e8c1962a
- Size 6.3MB
- SHA256 bc6a214e9a72717c56e688833ac6a09a32a3015a694d01ca990cc348e8c1962a
- MD5 95b0a74d8ebd3d74355137b65666c30b
- SHA1 6b924a418634bd98eb990bee168fb7dc5743f9cd
- SHA512 716eeca77757e5d5b633c44949862703623b747ac64671b62b54d3c33e77f8537dfc7a8a28c25064a168c6d99ab2ff4c3f0e014ef6f91e51d74f7684a7313a5e
- SSDEEP 196608:IkYWklz2j3gokQvi4abbi4AR0fVnlR90EVKp2:Ik9qygZdfD9vVKQ
- TLSH
  T17C6633DCD5F8C1B4C27409F53D04AEE398A7EA7CA16891E92F36D0B7651AC0F903A563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DialogEx.dll
- Size 23KB
- SHA256 2f53638b4a369cb03b27d0b83e8ce558fdb4988b8b3f947570c5aa7ca8ba890a
- MD5 fafee34d85e384b446a2e9f3ca40897e
- SHA1 3051eaf604e6014f2ad6f2f630202d9347758cda
- SHA512 0832bf851cd6d1a7c769f06a27fb565f599b596a90bfe9b2161fbb1481a420fd61a3732bdf73dcf725342345c6826ba9810e924d8538d0ed56da4671f2ab3389
- SSDEEP 384:pwhrDZsmEW0VdMOIgG2QzeSJ0ewJxSemwsn3EO6DD2Rsl:pOt0XMx/BzeSXwJUJxnUz
- TLSH
  T150B26B8A72F446FBC3FE227015263B4B66FF5E1058F1840E4FA707941897A8B5D3422B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/SysCompImg.dll
- Size 4KB
- SHA256 e1775d36745b9973b7e495d64f4ca4b0c63cd10606960f888fd731a60fba1408
- MD5 2cdbdddd9c89472f1c7134f133fb55b2
- SHA1 379de527f952eb2e473c3087a442331b78e8c700
- SHA512 a9c0228c22a618e2318113ecbcfa63b043c2aa86d3fe0625026a0cbc27a90f8d23da5b6b923043d7ef05bb0069e8b322326c34ce6fdf06d59864beca04bb56e2
- SSDEEP 96:mZSnQTwkX4fmwc17GzQZEbQWyofYr0s3:DhcQmwQGc9koP3
- TLSH
  T1C591B76747A4CFEEE1E7417C365B7D0E12B072819280854EC64A896DBBA71DA413A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Imagine.chm
- Size 27KB
- SHA256 57311159c62341587ace94f722a12dc8c95f47b67b1ee83efe6f78347de35e16
- MD5 d66a15135e5a9e314430af89d64705a4
- SHA1 1b5fce748a22327121899dc6fe0d5b62edc23903
- SHA512 2c75b2df4733b5440cf833428d661bd917b13dc5d4210e98b235b25107110248340fd2a65dfc0c294724d9f5ac18daaad6429700f28929cd647b6bcf86098aa4
- SSDEEP 384:d9kqgNmjVpUWGs9w3floIjkFYQ9K+7Kbewx7cr2kCtXsmuxVXhGn3XM35fqjp+/L:d9zA29efm20AkodGJmimM3dAk/NR
- TLSH
  T190C2E113B7932056D902627D7F9891DA24F87EAA1C946246033E5989EC95FBE4F04F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Imagine.wcx64
- Size 7KB
- SHA256 f55f09defcbdbe7e39e58771d4a7c1ada5ae0a49ad140846ff67249cffc07fa9
- MD5 2805d344383277c284963e1b89195369
- SHA1 8aa79b02b97bc4c338337e48e75ade3fe76b985b
- SHA512 4875c2838a67f5e5f29a8cb0fdad54168fdea9ff2571da64c3840efa0be8f56707280fcd5908a344d88859dccbdb11d3b85d6f10f1eff5ca9e7b55dc5a741fd9
- SSDEEP 96:cdrTtDkcEUbPFiL9H5u9qHGnD4mNW2tx5DdKdeF2A5eun9c:suc6hHs98QDzOesA5
- TLSH
  T139F1C71A9388C5DDF46B877D89EE06A39232B454672181EF2290463F1FD3BE1763B760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Imagine.wdx64
- Size 13KB
- SHA256 86ffd76a6b2158ce1dcb88ae0ebde9d9fb50e91759a2a1cd69357a4b7f3bd436
- MD5 d2f8bb14ce8ce4c3145b3bd5d4ff20b7
- SHA1 3d840f5aef077733e727280d0e0b7afab79421e2
- SHA512 a2ac0e18e6fd210c815ffded1c0acf3b711d505f826004d93b90a66e31791f936a2860d50afe2de85eca2478775f696b37edeb044d822193f69b78ac03f63c4e
- SSDEEP 96:gBKbWQ3U5dLXyHWmqFk0gENydohVxtuak/vmyrGCltpNhh0mi8GIgQH+5N2yyepP:fb5E3409gQM8Puak/lFhh0m1xqZ6n
- TLSH
  T1D152B8895780819BE0AFD0F58AE38223B915B818636157CB55D0CB25BE43BD4363EFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Imagine.wlx64
- Size 5KB
- SHA256 53504192bee7b48691cb61cc4dd183426caaaaeff017ceab80b5732b68995cfb
- MD5 185f6d65f0f146820f6b21bedfdfff43
- SHA1 28160aacbe7fd0e6967f9af2efc1f2fdc1294d56
- SHA512 f3082689914f81338295e05c4aef53572ddc186891d6c71e2e58baca186709b2efa9302dfc4e5dc3df4a2e2e2ff1fe9bc08eb89f81de9ea161e8232d8a818a83
- SSDEEP 48:69A/oMRD1E+4OOn50IauvwOoECpYRS/epbMTxJplhGTlch66hwkO0KcIc:TBDbluIPYdpbMTxJdGsSn9c
- TLSH
  T161C1844363E800A6F1EB93BD44BA0B42A176BA20633187CF127001292956BD77739BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Imagine64.dll
- Size 3.9MB
- SHA256 8671b3a3e32fb7d6bc8573ec13f6d57dacc43ff8218b632e63517af33321fc14
- MD5 e4a312b9016824db624e436dbae2fcff
- SHA1 c28e7c416ce97461cc8fcb2d4dc7afa659f0f676
- SHA512 0b775b63d87dfd36c6b330df5150ae530941d604586966cf154b898c99fddc979c4fe818875722500f917f54a4caa383dc1a98f4d4c118c8606bcb627b7e0acf
- SSDEEP 49152:1SDI/KO3dm8Yo4CvzVXFy4N+ImRVVPcJY+KDtgj3H+oGaBHn76+cEGJDR6pfTXKn:QDIX397Vg4NM99SjZXO1cMZ
- TLSH
  T113166B52E2D001A5D1B3C179CE968213E7B1781813F183D7B190EAE93B23BE5767E396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19 behavioral20
- Target
  Imagine64.exe
- Size 15KB
- SHA256 920caa9e8d8a1ccbf1f957b4e486e7ff6ce3ed4305ab8c741913f35e80f9fa41
- MD5 3980d3ea7df85264e0156c2ac3c86550
- SHA1 018e869da21af858263f05acfd9d18eb51ddc32a
- SHA512 9868155f0b5c77945b8c1d0b43b55225d4811e463f70be04126a70be250f94260b77f6e91952c53ffbfa19526dcc30d81f671ab7895fcd8575876c91e4369e17
- SSDEEP 192:mIivtuSnHnHXEQg9TfMMxv3h9pxqB4IC7dcwICB7ucuHpUynT+v54UMRlH:mICtuSHHXEQMfrxvqBAizA9eF
- TLSH
  T1AA623C0113848C18F4A177319C6B5B71AA75F81992EC138B3A2D6E9EAF217C1FA37325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Plugin/7Z.plg64
- Size 48KB
- SHA256 a5f2661a2fe95e2111d81837cd20f80afe8500b4ee8bf578a9f85c42bcf49e46
- MD5 20cd1fd2fd78ef80ae692f780769b7cd
- SHA1 79666317b5a7e9b343e8ce17ed18bd63c8f30271
- SHA512 2b0ec2f943d7ce8c5bc0f1a0f20e6e394bf09a0087dc3b8da67e0d47ab9bcdb6f16b8b5fb2c29d2edffc543ef7b49e21f1720b3e1dadd345a66ac9417ce57878
- SSDEEP 768:dzye5QdH/bIF/WisVig4scA9p2MV1x7Ax01tCPEYGe3dVOR:J3udfbq/84scA9tZn2
- TLSH
  T196233A93D3C180D9E1B78238C61A1AB3E7B9F414272193CB5AA09A7B3757ED41E7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Plugin/ALZ.plg64
- Size 114KB
- SHA256 789d539529e4d1ad115740ff8b06689e655d8397cdf2f31031d2c962c31f5bd0
- MD5 e02f32d4d3d7e9dd3885ef71f699a271
- SHA1 448b8b890b57152ba42dee2a04d9c608eb3cbf81
- SHA512 f634e22f231506087936f4088550f6dc0deca0d235217f710a0ba833734c531106815e6a9c6f8a0fed00bf1321f3184d8fa193b7be5487c115fec9c135bd380d
- SSDEEP 3072:TlxqK5hV9U6NBdU5Q5ksODBbmUhhQsDTsf76R4:rX55U+fAOfO99hhQsUD
- TLSH
  T120B34B82B18440F6D1BFA278C9D20B13D3B2F0285771A3CF1AA456291F53BE96E7D365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Plugin/AVIF.plg64
- Size 6.9MB
- SHA256 fecf60ed3be105ea329f581000057848e29b57c0b34b2331df463f7ad5572e16
- MD5 4cc48da44c75f511b20ee6ee3854f9bf
- SHA1 86461a8fa3db2ee96fadd8a83a9d81552c3ad22a
- SHA512 8b2e258d641f6d8fbc6904f3c5258fdefdd18ed7dc19245ccb7440bf87f17136147b233ce16bc368f46a655633fc1dd596b29a155154405ca008cb96b120fabb
- SSDEEP 196608:L/3DjAPUKGfAxiESVtZtoZqCVR/VbduEwE3EjWD2xyZpp+nTCOC02XyNO8nBD2pv:LDjAneHZtoZqCVR/VbduEwE3EjWD2xyn
- TLSH
  T17376D04AF29391D8D227C4B49677AA15FA24342E931952BB33E9C5257F937E04B3EF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Plugin/BPG.plg64
- Size 255KB
- SHA256 1aab6fbba5c9ac481b8c8d5d1b911e3401e8597f704e9061e31cfd91390b82ec
- MD5 841cc81fb8f5701f8a65f05541e4abb7
- SHA1 9270ecf09f5118f488964aff61dbdb7ce9dc6541
- SHA512 72ed15347564fa4582fca52631c98cc5f696644bc7247075abe62aa61a91c68c232733df1bb4c18db673bc029d10784b17acda5c4555cd0d3b9538154ea89898
- SSDEEP 6144:VBpgzI3Zh7plekEiINFrnM84G2MGmqoXXT75bhD8RWbj:VczIv7povrnMtGcmjT75bF
- TLSH
  T162446D45F2A60CFCD967817DC4970686EBB23C160318DAEF53D086662F23BE0AA3D755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugin/CLIP.plg64
- Size 267KB
- SHA256 50b9ebc9d5e5588402e6a401e4fa6ba59d5777bf84b55e2bce2b27ca625b5a43
- MD5 ed3703bf3c52ed7b8ea7e27870f0b0db
- SHA1 1a5b87f96f75472c8f84ba44cf0acd62ab01139d
- SHA512 b71179e2bce454a22c0140c95922035c240b4374ff483ca15e85866992224692c397f58631931fb9ef21642511c0309a4e2f433e5def6f396336c66d892d55a2
- SSDEEP 6144:qFedz3Y4XpodxUo9jbHv0JBzh53h2RwqkDsxiNlaSL:qF0zIOpsxUkP0B53IRwZIxi
- TLSH
  T11A448E66F3E646F8E87BC175CAD54207FFB279092234C68B9AC0CA556F03B32A52D315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32