861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27

Sharing

Copy URL Twitter E-mail

General

Target
vxnperm.zip
Size 2.2MB
Sample260804-nc4hssvsfv
SHA256 861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27
MD5 ced68ce2f1953788f9150cbd52c6bf4a
SHA1 05bdba9f90c3b27b37c0161920a7d8ccd4b040cc
SHA512 f103d053c59c4982f5b5a8e58612672c37337f90b6f4772654a6d41869aa96938fa845da9182e2697628894641c0cec81e5dd249886855459c3482e77918ccb3
SSDEEP 49152:56pq31lOOiTF0AmUxTKMfGICFsdPmj42QklJbMWrE5w1wv+/1tgXpmVAhRSNvi:sWTU0AmUZffgqdPI42QkHM6S/2NEmV8/
TLSH
T108B533CEF3C89F56DE0F2379A15EC1D9A5EE39F41074983C6812280C6EC36958D82AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  vxnperm.zip
- Size 2.2MB
- SHA256 861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27
- MD5 ced68ce2f1953788f9150cbd52c6bf4a
- SHA1 05bdba9f90c3b27b37c0161920a7d8ccd4b040cc
- SHA512 f103d053c59c4982f5b5a8e58612672c37337f90b6f4772654a6d41869aa96938fa845da9182e2697628894641c0cec81e5dd249886855459c3482e77918ccb3
- SSDEEP 49152:56pq31lOOiTF0AmUxTKMfGICFsdPmj42QklJbMWrE5w1wv+/1tgXpmVAhRSNvi:sWTU0AmUZffgqdPI42QkHM6S/2NEmV8/
- TLSH
  T108B533CEF3C89F56DE0F2379A15EC1D9A5EE39F41074983C6812280C6EC36958D82AD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Drops file in Drivers directory
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  vxnperm/RUN AS ADMIN TO SPOOF.bat
- Size 318B
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH
  T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  vxnperm/deps/AMIDEWINx64.EXE
- Size 377KB
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- TLSH
  T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  vxnperm/deps/AMIFLDRV64.SYS
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH
  T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  vxnperm/deps/EEUPDATE.exe
- Size 4.5MB
- SHA256 bc195aac847d8015d875562be929804e59bf0c0cdab5407a06f3359be98641a2
- MD5 4325420a99393a6ad6044818ae61f945
- SHA1 cbe636eee83e6a016d0ed65a09dc88a5cb8398a3
- SHA512 30a7456f6c55d957a9bdf9ca1f9c2fb76f6144015f24ccfcb5168275996091c425dd86e08b6d0b4940ff63af6876b1393aa8926bef62a880a5ff1b9551f5a0ae
- SSDEEP 49152:xVBQSmh7Dtk/bX5YuWI4zAXFBVTf9UnoGvlG0unS9w:9yD+/VYzI4zA1BRf9FGvlG0unS9w
- TLSH
  T1C626F957E7B321F5D4BAD1345143733ABC7274698338DBD79A808A1A4732BE0A93EB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  vxnperm/deps/PSWOA.exe
- Size 397KB
- SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
- MD5 d30a3ee3eafd3f37015366868c09e725
- SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
- SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
- SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
- TLSH
  T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  vxnperm/deps/RTIoLib64.dll
- Size 155KB
- SHA256 e68365ab48c6fa3b3c8036c578cd61793e645b76c8a17641ff07ad01038ccbb8
- MD5 23b63b64c57ffe0129af6ee4b38ea7db
- SHA1 ce0cec8e15d7d9cc861613a6b2599cf2d580c70f
- SHA512 3a5b19c4363e4bafd6a6ddc538ac592afebd81b6de05687e7f169c402c232ca9685ac36391c03719e588b919cdb0fadd56b42d26ae90b1e3aa3e231e0686e4ab
- SSDEEP 3072:RMmIcRC1BP5gn6ENjoJszSKKmNdWTZILJpu9S5:OURC1yvm2f9dWYpJ
- TLSH
  T110F34A91B19200F4DAFA993489E54A06F7F178244325A7CF266082270F73BE9FD7E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  vxnperm/deps/RTNicPgW64.exe
- Size 745KB
- SHA256 791d18024007d988725ad24ae499f9e8f26dfc1ac8f95f9094568fc5c300d0bf
- MD5 302a86510b5c2a807bfad326224880d1
- SHA1 0afea09cb54d9216895e1ad2e60e2606c89d8697
- SHA512 a4da927d4e33639b97062fcae6003075e60ce939edf7e807119e2f5b300c0918fdbd801668d78e8a707e920bb7b4aade72ed4ac3f3168129b1af2fe40397ff4f
- SSDEEP 12288:pp99WL/vCzx3QRIL4DbKsxA/3SYsF2WKEnkiUJ0yn:r8/vaN4PKsxisF2L+yn
- TLSH
  T11CF4B05E56B106B5D1A68230C596461BFAF530100328EAFF66FC4AB15F77B862E2FF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  vxnperm/deps/amigendrv64.sys
- Size 36KB
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH
  T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  vxnperm/deps/i3782.bat
- Size 5KB
- SHA256 5d1c7fc83a9b03ec15af37328df37e71e222d0433dc513e01b6ca0e161457e07
- MD5 b3c2e53412fa8d74dd0a9ec7811f16b9
- SHA1 3d1f49a3fabd821967a943d353444bb3d08f08f5
- SHA512 a55ddec20d0658e260190b236cf0692501b94ce2ca0e32130f5a613bdad2fd9171574df8e875df0ea61709864ae062f57960676f8e0f278da2e79b65e1097498
- SSDEEP 96:3UmsVWzs0hTky9a/Pijqp+akPijQBMMwVgsFgH4VfFtK6zoyN7t:EphyOYtfsFga06zRN7t
- TLSH
  T14BC143BC6ED0A231DE9AC716AE2650C2F366D1B60126558C30DB90A8F60747C737EAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral18 behavioral19
- Target
  vxnperm/deps/iqvsw64e.cat
- Size 9KB
- SHA256 bd4f42c45db35f9b042d610fab4c9810132dffea07265422f360b342b4a7790e
- MD5 93e365f71c2e9c8d61c64f2783fa0868
- SHA1 b3662eecbeafe5af9ee3be504df77cbd99fc7c36
- SHA512 031e615503633fc643dd72f44eeee7961361945a5ba4e6d2dc0ff184b38f7e2b65a5e9ab53315b40e895a9d7fbce9a91f180bac6738ee681744f6301ab0c5838
- SSDEEP 192:Qt83i2oJCuvyyKwnsFWQF7aCOJxZAqnajKsQcLIm:cdrnsFR5aCOJ/AlGsQcsm
- TLSH
  T1DC22D7E24A6C54C3ED53286043A8E567BC3D6BCB2C50856D31AFE7A51C83BC5E70856D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral20 behavioral21
- Target
  vxnperm/deps/iqvsw64e.inf
- Size 2KB
- SHA256 4af639c5c9f9106f73985a8c53a916d73c78a3bf67b450eaf4b06387129c3975
- MD5 9fc2029a6ebf64e1af9f656b82fdea1a
- SHA1 20c6e51b5dacde55d80b0873720f987d2593c47a
- SHA512 1ccbb5c488e7967baadca45d241f5d66ea1559d886662bc25c86b91634a7639416d5a8777f1e07a1b7d3cc638b857d32a52ef2960e935cb03c682abe4827dd02
- TLSH
  T1D141CCAD19E34E49767B34A193A3CAC2F210200609443D8D345EF4A5AB3ED9DD3659BE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral22 behavioral23
- Target
  vxnperm/deps/iqvsw64e.sys
- Size 61KB
- SHA256 a1c886d0e3b8dae271940d6c366f10fa54aff9582ee571394d7b0ead60f9c609
- MD5 a04fa610c631055c3c7b11df5887fbab
- SHA1 b37916fb4a764aa82cff5faba997437d3d93fb30
- SHA512 4fecdb2de280cd251421e3f09188b62fa95732db19488846677e75277f0a271d06f5ae2d38b62b65b359c03d715ece14cc5ff11aab0f7c4520bdd10904740f92
- SSDEEP 1536:LfeG1kQWHBqSfyAXy5IFCxxoPt1Q+8iAS2w2zB:LfwFftuQCr5D3t
- TLSH
  T1255349C72BB420C4F8FB9575869AC66BEFB0B19A17324BEB06A5C0550E533D1873D683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  vxnperm/deps/rtkio64.sys
- Size 53KB
- SHA256 4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7
- MD5 96e10a2904fff9491762a4fb549ad580
- SHA1 02a8b74899591da7b7f49c0450328d39b939d7e4
- SHA512 06f477ddbcac1b1e79f142b4c0476e5c27b2a002b8d84ca098fc2d66df9b6f4ce6fe2e4c1648b061f594ad7c410e6daa37526a84d4f5b379699e8c8a89147ee9
- SSDEEP 1536:raz9Zl4jhovMHMvi78HOXtcrEC4RsbuaUfc:wDk+MsviouRC4a
- TLSH
  T196336C51C3A40865E9F7CE78B8F8922AFEB1B445A734C6DF0218C1919B53BD1AA3C356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vxnperm/deps/rtkiow10x64.sys
- Size 63KB
- SHA256 ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89
- MD5 96a8b535b5e14b582ca5679a3e2a5946
- SHA1 f6b3577ea4b1a5641ae3421151a26268434c3db8
- SHA512 ca8ec4cec41e47560cc4d3b3af7bffa5c27455a1f55cc6ca1f3b1553ceda93b501a62a3f3599db1c88fd20fdeb48630973255ca23129b7036e938c7faaaf0376
- SSDEEP 1536:+OsdGoYvrhm0Kxu4RN496QOxsbXgkUfQOLf:Rm0K321OcoLf
- TLSH
  T1BB536D9197E80891F9B7CE7165F89057BE71B6862B31C6EF0229C0649BA3BD0F734319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Process spawned unexpected child process

Drops file in Drivers directory

Executes dropped EXE

Stops running service(s)

Drops file in System32 directory

Stops running service(s)

Drops file in System32 directory

Stops running service(s)

Drops file in System32 directory

Drops file in Drivers directory

Drops file in System32 directory

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27