6f35b915daa5c635f6a05e04cdb9b4aa5c682262139316df3ddd6cd412b18eb4

Sharing

Copy URL Twitter E-mail

General

Target
JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe
Size 17.1MB
Sample260810-274zps1cmd
SHA256 6f35b915daa5c635f6a05e04cdb9b4aa5c682262139316df3ddd6cd412b18eb4
MD5 2415c2e603d6b2941942824eae665f3d
SHA1 24a878f6f853bb39e254cf1e97b747cdc61f84bd
SHA512 1f85d4586af6af9794b1b94b7c1c337440a03d96e2f315d320d36706eb2c0b139d9cb411a9c72b747f4f2ee6e8690f7a04ea29c6610ad7bced3fc98bfae65330
SSDEEP 393216:QzVfLUnmhNw32VNelklzfhPdkmpv5JwuFUvmB8SO3DOgwtEI0ppjagOibnaEIBT:QzVjUnlA88tPt5JhUvmOSADOgXOgOiju
TLSH
T1A20733917CD4F70EDCA8D838C8B053F041EB1EEEF6715417A4A17E6637B6283D29A846
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe
- Size 17.1MB
- SHA256 6f35b915daa5c635f6a05e04cdb9b4aa5c682262139316df3ddd6cd412b18eb4
- MD5 2415c2e603d6b2941942824eae665f3d
- SHA1 24a878f6f853bb39e254cf1e97b747cdc61f84bd
- SHA512 1f85d4586af6af9794b1b94b7c1c337440a03d96e2f315d320d36706eb2c0b139d9cb411a9c72b747f4f2ee6e8690f7a04ea29c6610ad7bced3fc98bfae65330
- SSDEEP 393216:QzVfLUnmhNw32VNelklzfhPdkmpv5JwuFUvmB8SO3DOgwtEI0ppjagOibnaEIBT:QzVjUnlA88tPt5JhUvmOSADOgXOgOiju
- TLSH
  T1A20733917CD4F70EDCA8D838C8B053F041EB1EEEF6715417A4A17E6637B6283D29A846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- TLSH
  T158A22B5353A01FFEF3E7153878B27B3745A99A6450938A9F07B32D8D2566282BD32342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 6d95897f302bd75a8aefc8db32a826393bd52c30057bb157fdc68d97c47bb919
- MD5 114e8d7f1eb28894ece784c8d1370398
- SHA1 4858085fb0d3f4e941b237e483e7d9c69f3bf9eb
- SHA512 41cf4fc9b7287c64ff036b7a347363a4a36d7feeca7f39213a358cea2d3c7e3cc2c28d406d2984300e6897187d9b88f423846cb2a4a20aaa7e1cbc93dda910b5
- SSDEEP 192:tQpTobBDV6g67UmsEw9E5aZxwXTBa1uayR/H3p+57CvZZ2DDFVnF01Dwn2GRbgso:mRoT6gw51IE5aZOjBaAN/XpWzqNw2io
- TLSH
  T1AF624C11A92008F6C761153470E33BBF6BB34E72571481C3ABE3595EBE25703AA71AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH
  T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 17KB
- SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
- MD5 88ad3fd90fc52ac3ee0441a38400a384
- SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
- SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
- SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
- TLSH
  T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsArray.dll
- Size 12KB
- SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
- MD5 0917ee492308b691326e6581e8c793c9
- SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
- SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
- SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
- TLSH
  T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
- MD5 f832e4279c8ff9029b94027803e10e1b
- SHA1 134ff09f9c70999da35e73f57b70522dc817e681
- SHA512 bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
- SSDEEP 96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
- TLSH
  T19212F9675A0011B3E9A3223D306A2E3F977C9325D0527C03C677AE562BF031A7D3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
- MD5 428c3a07fba184367a5085e46e4a790b
- SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
- SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
- SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
- TLSH
  T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 21KB
- SHA256 15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8
- MD5 b7878c46c342f851d35fb2dbc898a593
- SHA1 dd0ebd231edcfdc0a561cbda733c58e22ce3156f
- SHA512 d7f179d33695b62da5fc0643fac461129975e78a8694c02e8c8d74471d0ee4061b92f1010401209605146861b259d34079583b2080c8ba69382c2122d9b969c2
- SSDEEP 384:QYUEEoUMA9RoB+cq4OJTv/ldPWUn2kaVC+DEbXG989qX6rMIZy9RrT:PeRoBXHoTXld3n2XubXf9+EMNvrT
- TLSH
  T152A25B566170A8F1F92618FAB9D26E237F7DF90834745897CB23056D2A91863BF3C312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/processwork.dll
- Size 231KB
- SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
- MD5 0a4fa7a9ba969a805eb0603c7cfe3378
- SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
- SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
- SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
- TLSH
  T1F2343B36E1C0CC76D5672B7CDC49E3D8556EBA302E2898866BE91E8C9B3D391351C287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $TEMP/Internal.RMM.TrayAppLauncher.exe
- Size 146KB
- SHA256 dc797000cae005b4bedcf3876d622e83c0c4367023f2808dba6b65797716bd38
- MD5 5a41bd11322a8e202ccb6f892dc92473
- SHA1 8a58febae10c6b2dc7878405bf64ed57b01b90b7
- SHA512 ca3e4f348facde227302134b7e2d1113a13af14a6db22f0d2ad1a31c95c03329ce2b1ec5ffb22daa432b68cfa6c894727badacbf8d5e7e748b517ccd3e547936
- SSDEEP 3072:n+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwx4B6VEN:n+f4nKvaQhcF7qIBxuZjwKBEW
- TLSH
  T148E33A03B2A810FDE1BBA37889A21901F3B678554B7297CF0390C56A1F67BD09E7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  $TEMP/RMM.TrayAppLauncher.exe
- Size 146KB
- SHA256 dc797000cae005b4bedcf3876d622e83c0c4367023f2808dba6b65797716bd38
- MD5 5a41bd11322a8e202ccb6f892dc92473
- SHA1 8a58febae10c6b2dc7878405bf64ed57b01b90b7
- SHA512 ca3e4f348facde227302134b7e2d1113a13af14a6db22f0d2ad1a31c95c03329ce2b1ec5ffb22daa432b68cfa6c894727badacbf8d5e7e748b517ccd3e547936
- SSDEEP 3072:n+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwx4B6VEN:n+f4nKvaQhcF7qIBxuZjwKBEW
- TLSH
  T148E33A03B2A810FDE1BBA37889A21901F3B678554B7297CF0390C56A1F67BD09E7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ArpLookup.dll
- Size 15KB
- SHA256 5c93c0b7447f4578ba1460bbf2936f32250db7be6e5a40fa12b50711f82df0d1
- MD5 836225137fd1b8872da2bb21134aeaad
- SHA1 812ab6cd8b7f20c02ff9303e5e9eb9b1677503af
- SHA512 ddb282598c64f7aea6518ed0afa49193567973c87db1678c7cd921b086b49aa567bd1cfebdd0618dc150cebcc8f8588de129ee7a2e3907d940e52d84a4942699
- SSDEEP 384:54OeITVDIvgbY3OQMlWHtIxtTuJO7EnLv1tx1bf:4Am+QM4H08n1Bb
- TLSH
  T13C62060093985337CF6B2AFCECA323914279D3156503FF2FE68E95D62C46B5E8511BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Cloud.Backup.RM.SIO.dll
- Size 102KB
- SHA256 7db80f1694aad508b47726f1b1827356f29d853a27006700f2473ce087037413
- MD5 03947d8422aad4cd0ca2579d6d937399
- SHA1 42c4422e29e7350a2474f474f1ed12c80d3e255a
- SHA512 f6f9d9f32d3cceb761f7b6ae5efeded884d9f48da726995abcbfa0d816fae761d6639aee269a914b4c3c594af5d5bf260e40f5ede10e30a57d8da26b8f0fe5b5
- SSDEEP 3072:34Ny1R2hVeF6Dr5AajSrvbBpoBc7mSfkmLS:L1MveF6DrZKvB
- TLSH
  T1F9A34A02336C5B33EBFF60BBF46142928776C916F007EB594D8CB5F968533909A0266B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  CronExpressionDescriptor.dll
- Size 29KB
- SHA256 33392e8eae26d581f25f8f107d7ac1287d4b2291a02bfb07c988cda8c20c2284
- MD5 744a36c008f35869d4551a38d8facabb
- SHA1 b69788c04ae9e9403978f709aea00622aa5fa22e
- SHA512 7b4bbc66298140e9e77791fa8476f68a2bbbea84459a9647d1291bb0294dbcc18acdda145cf60f2de0302e2a78a596f76018a5f3683f7e1ebf2514679241b9b8
- SSDEEP 384:9O/D6uErTu8oFSTTTnr4umoFC56lF+kOWixFZ/ofNkTJ59enMM0cUVE:9Pa8NTM5s2TZ/olWden30ccE
- TLSH
  T170D2E921BEFD4059DBBFAF368974601506367F4A6D23EA1E0D96416F0836BD08CA1F35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Elasticsearch.Net.dll
- Size 983KB
- SHA256 eff0ed9dd47e151cb4d6ab191b2412b60f8a482bae0db55e1478bd166bb74668
- MD5 2fb7f857c4595b23d60cdc19b0b37f9f
- SHA1 a48a5edc6fdcf488c540db88a8e59027680b733e
- SHA512 c78575e5d8ecb3996639df696ef349a698236fa9cc03a6efe7e9c3dce84285823050a0f691a7c891e8ff5d7d05416098e73f6a88021b7dcc7ae6d09fa5ca82b8
- SSDEEP 6144:gzpD/1GAW2JF8Sbqkew5S7mV0C8FZyBEH1ytu43fBx5Hi9yYYf2OkcUz/3U86sa:gisFZnmg/Hi9yHf068xWd3I0+g5
- TLSH
  T139254B8073909A2BD17F277AD0716A345379E0163B9AEF1F5121F9D92C93F442EB22E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32