Overview

overview

8

Static

static

3

39f2e3c949...86.exe

windows10-2004-x64

8

39f2e3c949...86.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

lan-share-lite.exe

windows10-2004-x64

1

lan-share-lite.exe

windows11-ltsc_2024-x64

1

nssm.exe

windows10-2004-x64

1

nssm.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    39f2e3c949eaa8f3929a93335d3e88bbdfbb2a50b8323dd0ce27986fb89e8286
  • Size 3.4MB
  • Sample260803-tnjknaca34
  • SHA256 39f2e3c949eaa8f3929a93335d3e88bbdfbb2a50b8323dd0ce27986fb89e8286
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target
      39f2e3c949eaa8f3929a93335d3e88bbdfbb2a50b8323dd0ce27986fb89e8286
    • Size 3.4MB
    • SHA256 39f2e3c949eaa8f3929a93335d3e88bbdfbb2a50b8323dd0ce27986fb89e8286
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Modifies Windows Firewall

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      lan-share-lite.exe
    • Size 10.2MB
    • SHA256 dcaf4747068486ca6d4d375c3b52d4317ac139a29a3febb74d1303a0e41bd610
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      nssm.exe
    • Size 323KB
    • SHA256 f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks