c89bd5a9e83e8eae4725af6050683f02eeba961368423d5a4296e20aed80ab29

Sharing

Copy URL Twitter E-mail

General

Target
supportpack-dxstudioplayer.zip
Size 22.1MB
Sample260810-dr8e7azfra
SHA256 c89bd5a9e83e8eae4725af6050683f02eeba961368423d5a4296e20aed80ab29
MD5 0965f968be769b9cd689a2095d4290a0
SHA1 6d217bb6995307791ea628eccc45508183123391
SHA512 084b65549e945fa94c6c9307634833d990e699adf0576b5bcba63db7bc03467700bfe83e7d8f0e9e6dcce059ffb5ac71bf09bdf1040dd0270aa848cecca0142e
SSDEEP 393216:PmtA4Koieqa31QPTCmc73jIKnWLZz3JKYG6FjjxNBP4gSJHGYN2sknG6TZ59:KK1eqa31QPoj5ncK36FjjplSxGYN2ln7
TLSH
T160373396181B90B37B2E6413C1DA664DE8DE11950308C873AFA54E6E3DDDBEBB37D108
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DXStudio/Awesomium.dll
- Size 8.4MB
- SHA256 2a1b4c3dd8eafa6113a2c379299356fe1d9a8395584134145fb51560b2cab576
- MD5 556185bb963af3c3bbe4128b8597eca4
- SHA1 05d9a9e53d9f49635a69dca186b4d0f441365168
- SHA512 ad6b9f6a831dc895bf8a96748ac33d83d103eafd078ec18056c153fdcd8ead40c5788b0bf1d113e0c605b5c18d72a350a0efa394fabcfb35e0a3a8b1075e6ada
- SSDEEP 196608:3S5w5g2DL0wy7QHyg5z0qvj7POJRQ7i55AMF5fE:3S57My+yE0qvjzOJRgi59
- TLSH
  T1DE967C23E9418135E6DB21FBD7FE7B7DA9688A10131951CB66C938846B706F33A39343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  DXStudio/DXMeshAPI.dll
- Size 744KB
- SHA256 985c6761fcb84985caee6566c0566f41b2a0123e237d21a95edcdfc9290adc96
- MD5 df293acb95a6c5fdf2f978f29b4c3415
- SHA1 8fd571df83961063c24a69006002c7659a34989d
- SHA512 a223c6134582879c58b1b35bfafb609b1a88fe30808e77c9e0fd72255f4a18332c7fe4a1ba417f2223e49691b2c32be1a642dbe660380294ea88e19616e979a1
- SSDEEP 12288:tIU7BuZXUrXH6PSRxfBMNDXUrxoXIISqJzRovtkxm7uFnDXmf0l5QTeyWZVQ:tItRg6PMJnESqJzWvttwD2sl2TeyWZK
- TLSH
  T109F45D016A42C139F9BF0076CEBE8A6E9278F971075590D3F3C85DBE8B668D27A31147
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  DXStudio/DXStudioLaunchStub.exe
- Size 94KB
- SHA256 5a1d7cec11d7da7059a8bafab697ca4129216fbad6e4fb8d343b64f262b20886
- MD5 92e773b697ea94707732ba97cd49b937
- SHA1 7e61f4ab1384dc9cffd9045ffdf382130f237ad1
- SHA512 4c041e120da112dfc42a8b333979316b7f49e6fc1614978c8870465e47b24965781b3290713bae314714c3909ed144ebd250335680df3f6ff37f33f1c818c19f
- SSDEEP 1536:tdQcmmz80AvGxoa8k/CdoeUPfAi5fd+Tu4uH+6Bu:tz5zsv1PUfAi5fd+Tu4uH+cu
- TLSH
  T113934B11B2D0C071E1A626315877C7905B3ABC226976CB8F7B943A6E7F313D06E36396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  DXStudio/DXStudioPlayer.dll
- Size 531KB
- SHA256 0360f09192aa6ebc947d109c8878e191e8009824fb09abca8f71d651720d5dc7
- MD5 ac98ff0b711b6631c5fe8a5417af8a83
- SHA1 30d7aebe83254c019980484f27c0ebfd004bc103
- SHA512 713205b6abe4c075ec84f3122ea138810e152055120efdff0d63d2989c901962d896127bcebe455cfc120264ffb14c807345757f3f48854ff0030ce287858cfd
- SSDEEP 6144:cbjh1POMh5gCmR/nr4UJ3bNmgECew/YzBvdNPBJuhRSxdFzkASicq7mWRfFSSdrm:KEMh2/R/F1ew/YzBvdVLuhRSxdDuSTUD
- TLSH
  T1E0C47C2137D1C172C17E0531391FD3A526BAB5A0DDA8C347BBD85B3F2FB4A425B28A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  DXStudio/DXStudioPlayer.exe
- Size 4.3MB
- SHA256 adab9794bee78c2165d0c41462493d0d910ac327c5c5d40f6a4a385274d8c2d6
- MD5 8da284ac158c04853b684bb76f4188fd
- SHA1 c2f50cefe4185cee96787c682a94c8a66563d742
- SHA512 aa629d87b2c0d6c2739d75cbd2b5944fa440c72c601055f08eac80b30337f748e73969728bbc95aab774e239adcd72965c1c29917e5cda34ac908633f6dc3122
- SSDEEP 49152:PJkmVztSltA5fJAbH0Lax5WO2+h3lA/i18QvRzH1KCpTlNLQRkioacQnCERyFs:PJBVtYtpwLaf7JHsiXvTNcR1
- TLSH
  T15F267D00F7E680A5E29739B429B9B31BC53A77D42B35CBDB93942D5B4870AC06E71336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion discovery
behavioral10 behavioral9
- Target
  DXStudio/DXStudioServer.exe
- Size 272KB
- SHA256 37c28a8367fdc14448d2ce6a757888ceb2cc0ef7bbefa4dbf28c7cecc03fd0c1
- MD5 6a457d90a2fc12e13f7a9e0fdb0085cf
- SHA1 0772540d282a98a5e6210ddef8ba73577c99ba27
- SHA512 4409cf38211b7e6a9e90872938ad56f9391271e08dc8a08abf6a7d70baf96a00a5a6415640b448ff62e55908be3295d8bff7f2c2386d9966e3e6fdbb07cef36b
- SSDEEP 6144:bD7xbW3sP/HWFEKOBmsrjHSk71ukLBw70qIgFscA9R8:vFycwOBxr7S41ukK0qI4sRM
- TLSH
  T158545C11F790C432E5A32573497A86799A79BC31DF2592CB67C03B3E9F316E1AA30316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  DXStudio/DXStudioShellExt.DLL
- Size 558KB
- SHA256 6584f34e756476f9c6bd8f02359d190bd2ea3efa24600a03397713e2b722769e
- MD5 df8ae75df59d7d1864a08ae7c2b7359d
- SHA1 69f439c538845cfa40e15188f4ec0d3496b68a2c
- SHA512 377c41f7b7f18ae4cbd0a34b0a0b139f7fa620e67c1e8fb9871c441789042c77612c0475cb12fce3000de0b6416cd007713ca2e633410ec8a30fcc2a285e7999
- SSDEEP 12288:IXBjln5CD0H4l+16tokag3LHXJAUTgcP7CzN2aIb83ARrDS8gcnL:GjlJjuHX7T5YN2bb83ARnS+n
- TLSH
  T1FDC4D001BB90C472C5AD25356156D32557BEBE619BE4C6C3BB983B7E9F302C0AD3834A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  DXStudio/DXStudioWML.exe
- Size 168KB
- SHA256 9aa86529a81e2dbdd2e7454fa6a8bbf7428af9442e605add9c81eca8d0228dbe
- MD5 f7f932943a9d17e1f36232c35fcd3c44
- SHA1 e471969d719c0df18436ab67e6f91d1f85fb61a4
- SHA512 3d2bd35ad4ffb54992725dfc660d20505b043bbdf0df3ca50d9f34c4300e6b88f3f61c50ccf2ef2856414cf0a41f8009217f1e474a1056806f723498b3583d22
- SSDEEP 3072:m8vExJLbWwc2aX6tbodNOvBNeitx00000g2p3:6XbW2kEoypx00000g2p3
- TLSH
  T19AF30611769284B1F39907304805FAD4467AAE394BE5E18FF3B87E3A69312C35A7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  DXStudio/DirectX9_Extras.exe
- Size 3.8MB
- SHA256 4f2ab9a7bfcb277020fd0abf0b7a02f7c5286a3690f6dce6d3c38324871852ec
- MD5 5519bf6c29f60e90399a8ba1673b721b
- SHA1 4c36ea817b8a2ffdc4c920de59f0d12d61cbc32a
- SHA512 a5664fd99cda65c56a0344bc2669f16f153fb6bdb6d7c8ea0dbd5657535519c782ff5e5297d5392e0cec4e585c0b22588838a02615e84d7bcdc2b80181406d09
- SSDEEP 98304:1xEniusogFnzUvRBsdNMQz45FkF8rE9kcANWglLWcSgYlXLdo4m:XEniungVzCP0F4w9kHNWvAR
- TLSH
  T1AF06339C3348C1F2E7550AB080DC7A6AF7BAB3053F1461DB87656C2D3810A57F1AE96B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  DXStudio/NxCharacter.DLL
- Size 121KB
- SHA256 fbdb35c5763cc1bd0e241a48bd83dab669e61665c7d04fcc601ef7104b3813aa
- MD5 16186bd545cd3fdd9eeed1e3d7dcbb92
- SHA1 fb048b28a7519447e29a7fdf904fb3a9695f0df1
- SHA512 f196a07dba964fde6e6633bd6a436d7b704ea2f4f061504a4cdb8de51455e666585a2d211d36d78d40dad13774c2176558e16e5f358d88dbe562333316c78247
- SSDEEP 1536:8lK4d2q1Q3LLd+6+Y04KboPkRbEbmxtZ7Rt7Bq:8lK4d2q1scYU2axtZ7Pg
- TLSH
  T195C39E20754380B2C89E0E7D808187515B7E6BA37BFA51CBFF7805895EF07D41B76AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  DXStudio/NxCooking.DLL
- Size 381KB
- SHA256 7c1abc9f4a87f9ceb714aa57be3bc74a873f4dadd0fa0837a2927b73de2349f0
- MD5 8f5cc6150368f335547419dcd7c1fe74
- SHA1 31c298258af102cac3a4da59dbedf94fb10e89ee
- SHA512 e0ffe473a4cc67428fb0c3a6740c80e2155080cb8d5bdacee83243e0d782c8a67fb11713e1df37c45a85eb56f20d82af3195c0d9f1f65649c5152e651bbfc3f0
- SSDEEP 6144:C6hnCctdUpUJiSp6drbtQNKl+V1nkLNuA1iip71iAONmblytON:7jdU6JHp6dv5lan7AzAuZ
- TLSH
  T1B784BF20F6E3C0F1C89E057824462A4697A82B561B3E85D7FFEC2A8F9E707D095717C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  DXStudio/PhysX.msi
- Size 4.0MB
- SHA256 8b0c293b281024c71e0e6a858aebcbeb47ad595b6509ef645acb707a53cf1e20
- MD5 bd1ed17c7638dec6090832a3d0782f5c
- SHA1 66613ebfd49d518f0d1c6afdd4d0f8f3bb74f458
- SHA512 b814ad3f1abbdd06538d9968f1d5991017520e4fb7da752e6140ccbaef314a27679801a2c1d9b74480e435552aa2d5126ae04e1e8fc77c0485994c77f3d1a2e1
- SSDEEP 98304:ioXxSfdqJKgOybD33SekHAYo23glUbAHcw0JJQNt3uTC:iISfskqbTedo210CJJQNteTC
- TLSH
  T11B1623CD3AA6EAF5D5094130490A86186D7DACB40E13355A31397F0CEBB22B967FD378
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  DXStudio/PhysXLoader.DLL
- Size 69KB
- SHA256 606903fdd4e17e4a02d91278dbfaf130b939b3593d03619a2ede8f79e8cd2668
- MD5 27847266432939f1eb546c67d8a53283
- SHA1 f5bb498ebce114325d6f6496bfafbde1af59f0e6
- SHA512 c8737d81a946284284c4937e47ef02ad98f4ecbf87f340ebe0a3d77df3b99f5991e6925cf1693f0d4d90c20bf6f9cf76a41826b7d81e4fe824f597ebea096cea
- SSDEEP 1536:G4xFpk7BNjSPazZTakm3ZZ8IYYX9t9XkXXBRmB7:G4xFW0AeYYX9t6HBG
- TLSH
  T14B634B197923C0B3E4090B34A185C7D25FBF6D033BE6909FFF6606895E912D4267A6F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  DXStudio/d3dx9_40.dll
- Size 4.2MB
- SHA256 16fd909aeb68d0d1aca8529dc7f78880b97d6649d70ce8d03a2c858bc28e216b
- MD5 eea5e428ce63804f9b12d21c97b5968f
- SHA1 77a7f48f4bdb7e66ed5e524bb8879e3da0d6cd1d
- SHA512 545518dabd82441ddfc17fe1c1cbd7d14603bb58130de1307a31f73b93ca42afdf25dfcf481f0383c4e039edfe4a88ae7b84b06a2850c29bbc3550114e499c73
- SSDEEP 98304:E6EoQ715V9VRhAuR9ClDt2iHbEsX0sycGoKO0nceqyaWd2U:/Qp5VUuR9ClDt2iHbEsX0s6LO5Wd
- TLSH
  T14E16AE60DA8BC039D8CE5170450E73B9616C9B71036057CFB2986EE8AE777D29F3429B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  DXStudio/dxplay.exe
- Size 69KB
- SHA256 259be432af46687e13cade984f42e3ab7856655733b5ef6009638ddaff4435a9
- MD5 d01c1cdc443a51bdb8e6c33312ff0b0a
- SHA1 b37e1783429df957d5a25685a4a07ff09c9a474a
- SHA512 01c73bde27b4fa60f6a7abb699044741a8a6c77240e2b3450d66e8a5c2e296511a29f0a06a3b9c3310efe8a856abfb8b175d523bf49314eb98614a4c1a1f2336
- SSDEEP 1536:O+qMu0E3sQZE3RPArELPDdANfDUdc0+wiDi79D:Vk0jyv7Udx+wimD
- TLSH
  T1D7638C62B950C033D51A58745469D3B26A3EF4312AB9D8C7B75B0BBE5F313C06A3E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  DXStudio/easysoap.dll
- Size 236KB
- SHA256 f0fb6506cd0defb627927b6da0f0ab7d82bcff16c2ef1ca1cca2b10a14ff854b
- MD5 6f087729ac1b577308c4c8cdae153c1c
- SHA1 a4f8c4a962c66b03cf316e44c87bd220e849785d
- SHA512 c3ae0fa613173dcddf385ba573090c11c4f0514bc61f2ac79f332dd0ec7e48c220e8a1898ff3219b7f20d855a1b8cb8afa72b858170f88f92dac10466c506c1a
- SSDEEP 6144:yv0iRRB14f9SKAejilizFY3H/p/C/IO0O/Q:yV7X4GeOlcFG
- TLSH
  T127347E103BB6C1BAD10B413940B56B5623BE61636F6766C3E7481F2AB4F41FA2E363D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32