87d71df0ed1e6d538bf0226d6ae906828b75b8f2900a8911ac361e44fdf6ad8c

Sharing

Copy URL Twitter E-mail

General

Target
FreesmLauncher-Windows-MSVC-arm64-Setup-2.2.2.exe
Size 25.7MB
Sample260807-rxw61afm7s
SHA256 87d71df0ed1e6d538bf0226d6ae906828b75b8f2900a8911ac361e44fdf6ad8c
MD5 f3d7df3d748a5052496b49df2d3a8953
SHA1 1f2f3500c76c9f967c7276871547378bfd025c4c
SHA512 63e615e9d0e34066286dab43b410c75f7255f0f279831999b2fea9216816a07ce5370daa919a4e69b4e8ddf3033a9d969a04a3226824c35f244456fbac804d1c
SSDEEP 786432:/OXw9YT/p7fc/mhPr1Oqpyq9t+2e/WpyPPEdLIwKpe1:/4fVQgMayUY2e/WpKw1
TLSH
T10247331C81AC8EA3D2094C3EA8F66B3325CB39AE767955B735C134C31DC258F9999783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FreesmLauncher-Windows-MSVC-arm64-Setup-2.2.2.exe
- Size 25.7MB
- SHA256 87d71df0ed1e6d538bf0226d6ae906828b75b8f2900a8911ac361e44fdf6ad8c
- MD5 f3d7df3d748a5052496b49df2d3a8953
- SHA1 1f2f3500c76c9f967c7276871547378bfd025c4c
- SHA512 63e615e9d0e34066286dab43b410c75f7255f0f279831999b2fea9216816a07ce5370daa919a4e69b4e8ddf3033a9d969a04a3226824c35f244456fbac804d1c
- SSDEEP 786432:/OXw9YT/p7fc/mhPr1Oqpyq9t+2e/WpyPPEdLIwKpe1:/4fVQgMayUY2e/WpKw1
- TLSH
  T10247331C81AC8EA3D2094C3EA8F66B3325CB39AE767955B735C134C31DC258F9999783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
- MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
- SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
- SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
- SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
- TLSH
  T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Qt6Core.dll
- Size 9.4MB
- SHA256 2bd309ff7fc3bf524028a031e0323d2a9ab5afb150bf93f543684cf03a15e345
- MD5 27a5229add1f4a6217e80c104817253a
- SHA1 6b43aef6a29f45bed7c7e01afc733d6d11185d56
- SHA512 85028481e405505dcdf111c39da4ab5f1b9172d36a76e964bd9080bfa8f864e0a1737d20efee144f1ca74751b2e61b7464eab5a2dbd78630698de5e85953cdfc
- SSDEEP 196608:OiJ1cDyTVOZLXKFdu9CwJsv6t8qSScIg/3Uz1:r1ccVOZLXKFdu9CwJsv6t8+cIg/3UB
- TLSH
  T17AA639126BFD8112FAF7AB38DDB60A621733BD529A34861F5108221CEC737E0DD65762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Qt6Gui.dll
- Size 8.3MB
- SHA256 4c5515b200c00a71790e342bb2ef9d0b33d62b521a9f3eb1c220fa75023a08f9
- MD5 84c3d8dc1fe5c159810159c38a64260c
- SHA1 ff26151588e18720197d4445c9170000af79d49a
- SHA512 52fab94a7fea36642033b3ab93319abf1d866bc8077df7f3e860b2b3a2e91dc9874b512926e567eaea5803a7d8ce1ae70b3f818b8847c0f54522468dc3efc6c2
- SSDEEP 98304:4nn++qp5f4bnIxqSioOzEgiapmVzHJTo6pC/alLFu8aZAEdtoithQ:8n+1pBSI7ioOQtumVzHVo6pC7ZAvkQ
- TLSH
  T135969DA1670DA911E2C6E7BCDFEA0E31B51BA524412781894136228CFCD3BD6CD7D7B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Qt6Network.dll
- Size 1.6MB
- SHA256 90662dda320da5cb8273a0edaaf322605bb367c86253261b5f17d3da97d1e2ee
- MD5 34f4982abf87ae6ea47c6c200cb42c3d
- SHA1 d32ea776ca367cb9b1b4001d1fd87727a7968fd5
- SHA512 46a7204a7bca225859e9040f0f14c68f0cf7e8f37596545f058c9010a2a2c9462cad669d5864d06c9f856afb1750ef36997e1b8d5e206cd26463a84071047add
- SSDEEP 12288:LeWjFp2qUclt4NbAQ8USYTGQzlvkUcjXX4zU0B3iUOIcfTw58CVt7dbYX/AFunnO:EmgIcu27mQd6h9POIhN0
- TLSH
  T15B856AA3674D2902F6C9E2BCFEEE0A34B12BE518462781D95176124CFCC7BC5D92D2E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Qt6NetworkAuth.dll
- Size 294KB
- SHA256 21573f83ed56d2b0cfed8b250908b7466635c6a97e162a53e9154eb84ccb828a
- MD5 14bac0b6e053cab59f80dd8e73a4abf1
- SHA1 10661a089c7cda4188efa7be7363aa845dea15fa
- SHA512 0e29f325fc326505346b7b9ca5cd490bd1d087233d127a3ba1edccb6fca21acb2a2c9776f1a22b1dbde8c435ec1f5ac1cbfc7a2ca0cead4811ed5d013be42484
- SSDEEP 3072:VVZGVmZI0hMygiV30GrixcMYQ52m3DIy/g2Qz82TgGuxm6B4ExN4QUu07V:MIZIKExce3DRNQzRgGuxfBFN4QE
- TLSH
  T1EE541991A74E2A01D0E9B1BDEDD94B313527A900C327D5A69033678DFDCF7C1E92D2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6OpenGL.dll
- Size 2.0MB
- SHA256 152ca6f16c3c8ac2924d3d6b6dc352512afb7d5bb969fd2afe67bcbbb329b304
- MD5 28fc9c09e86b98265f9e38313dea6a04
- SHA1 2ec82ad3752a360bfc6fa24073bfbb20f97a781e
- SHA512 86fcb34fb478d8a927c1e44d0a8c8ca42cfb07b08220c21c08364d8f32f9b1d5fb38dbaee9e7f0f4e625ec25561461cd7939baf5f790961e5e4860f939c39478
- SSDEEP 12288:IabaXzTXKOgmXGcOUF0pPs1w31tUWqOs90UqREmU:Efw3LUWkYRZU
- TLSH
  T11EA51ED55399B722C9F2F1BD9B0F093D30E3DE56C0228A0398165B491DB566B0FAFC1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6Svg.dll
- Size 568KB
- SHA256 e4365000453d26884fb77ef964bc8fb6cd687cff047c536d7b1c1feb80686315
- MD5 6fcb7a402a79062f76e985e59568e464
- SHA1 d24b5b340a6206ec11545a7cfc794f9e8976a58f
- SHA512 7e19c5ab8bdaf586d383eb2d2eb8d1ff02fbe165a21123056b4fe50f0f6f8852cab88ec1535df14726161064eeb2fcfc4e19ff495b522192bf84bf328adc7271
- SSDEEP 12288:CL9Tqhz+mv7N08oUs7976tROC8WMNCEZ+sHUUxj:yeh47esYs0y
- TLSH
  T1B0C45B92734F5B07F1D9E27CEDA90A34BA37E008467785865036625CFCCFBD29A1C6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Qt6Widgets.dll
- Size 6.1MB
- SHA256 f52a0db6ad51c08d222b8ad2a082f6fa693a86472282f43a1f7c83f4fc8f3f5a
- MD5 9fc2feba6a68937f8438b8307956dac1
- SHA1 5c26e604e66a20a9fcb9ffc33e43342090b1e03d
- SHA512 1e783e3cecc6baa76e65278564f2a6facdcc26191cf016b2f378b3422909237db0eb7a567dbbf3d0e8ffd0acf033eb9c25cc37d7853112dc870e6b553485a31e
- SSDEEP 49152:EvqbGq44Jie7RvqTXGLdHZ0pgjWsF7fqANrRv1muSl8seoHTg+HvTYs:EvqbGR4JieUbwZLdNFv1mmcHTg4b3
- TLSH
  T135565A92674F5912E6C9F27CEEEF0B31B813A5148627818651372A4EFCC37D2CC6D6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Qt6Xml.dll
- Size 160KB
- SHA256 ad31a7fd563f8d0d4621cfec3919f8ebfb52de8be9bbb5f60092473c21cbb4b0
- MD5 b32c08f2782c305b31751b9bd29726c9
- SHA1 286f8da8f7951f1b71b353abb892c03d9b1e35fc
- SHA512 99514fab80dac7683a51851a1d586ca2643faa3b86a47d16814ffd7c94163515661a3874dcb0efe77c8bb97164386eaea162484f59418ddb36612436b1cdcbb2
- SSDEEP 3072:NKofSHjPA6wsCeH5sHKBI1fLsElpfG0ATg8Er1DbHWyD:sofSHbA6zCRHxF1DbHV
- TLSH
  T197F3FAD5369D5A02E1E5B1BC9ED50638BA379464C73343E1D03A867AACDBBC2DC2D1E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  archive.dll
- Size 726KB
- SHA256 e4d439b54c25b1bc15c2eef7fd9cc8118e673d32ac22336f256614f94c931140
- MD5 24fbd7fee711ff0ad1206e1e37b9728f
- SHA1 be97edc2836933806457d65a41fde6540a404741
- SHA512 57edf4ae63e88b2c3b30a825a2d2f305ea1cef616aeb4c4bef33d7ee11e27546e0065937bca6ea1881f9e2ad6866833c5cbe8085974c578bec16b0723cc94e1f
- SSDEEP 12288:mkUK7GFdg9gsd67CPrXZ63i/QtSy48kxaaBGcFLa4T2:mY7GFduXg3FH4UaBD1
- TLSH
  T13AF46C802A5CAD02F7C5E5BCAED74F727222B4A48615C5978131024CFC9EEF4E9B67B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bz2.dll
- Size 71KB
- SHA256 9f20991f870d2aaeeda62853c3f30546dbeca57209c67d3a69001093bcc21b75
- MD5 e52465ef9ac85cf6a78178b48e2c04be
- SHA1 d53c2e83df489fee48265b7fa3bebeaedb0154a2
- SHA512 7ec83fdb951236523763246f76cb1a7ca5d4437e53fdaf5782c4be77899709028e5f3b58266ff6a7a2b232c228e393a7dc06418c2ae34134d087186013fd2135
- SSDEEP 1536:s4xiGA7gMLyP2qZb+XFQpG22wqmqORN8:9xiGnM62+b+VUG2XqmqwC
- TLSH
  T105634D809749EAC3D6D19D78A4831B807316BCB3CB12A99955333A2DF7D6F949D3322C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32