General
- Target PotPlayerSetup64.exe
- Size 45.6MB
- Sample260811-ke728aar71
- SHA256 a6d7abb88966c51409962d689fb87313b282dbbc713a04321da462c6e0dbb9df
Score
9/10
Malware Config
Targets
-
- Target PotPlayerSetup64.exe
- Size 45.6MB
- SHA256 a6d7abb88966c51409962d689fb87313b282dbbc713a04321da462c6e0dbb9df
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $0/PotLV64.exe
- Size 647KB
- SHA256 606e8fa7eba8b9ded6a333093b033ac8842d48ed06d4b2bc491ad49e2f8e4299
Score1/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 18KB
- SHA256 3239a185c653b1f2385fbb9716172e116551fc68867e36ffdb96d5d7c8eaea5b
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score3/10 -
- Target $PLUGINSDIR/nxs.dll
- Size 6KB
- SHA256 ee9da9fad0ae660326395e1d5c293838253389f4939d6216aab945e0228fecab
Score3/10 -
- Target ATextOut64.dll
- Size 3.8MB
- SHA256 1e6e367bbe975800253680f5a9b90c3e8271d94e23a6dd83d54ea67c276314bd
Score1/10 -
- Target CaptureUWP64.dll
- Size 139KB
- SHA256 1fcfefd038d15312171b8ed92415138ef2b2ebce4f8961d40abdfef4c90bc66f
Score1/10 -
- Target DTDrop64.exe
- Size 131KB
- SHA256 4236596e352bdcf8e1ee944e04f88b5112634c216830dbe0388cf2e05d7d2b2d
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target DaumCrashHandler64.dll
- Size 185KB
- SHA256 ed5ca1e99615c579562f8fcdf89563478573230e59f51ba5fdc8b70c150c47a1
Score1/10 -
- Target DesktopHook.dll
- Size 81KB
- SHA256 e65b41954db6afcf9fb94459928bc5f41efb6e9cd5fd24dc2b88db964ab9e72a
Score3/10 -
- Target DesktopHook.exe
- Size 109KB
- SHA256 b3e938db80bb81e8e45038b2b7f884339feaab0b6cdbf27824eeabce157fe6bc
Score3/10 -
- Target DesktopHook64.dll
- Size 95KB
- SHA256 401dbb44405af94728a0f302f1b5e500ebb2ea2ac3540a52efa4563b5b9ea805
Score1/10 -
- Target DesktopHook64.exe
- Size 125KB
- SHA256 267eaae70d32f40233a4ca34d1059246fe7aca5d332c33d9696517251563c33d
Score1/10 -
- Target Extension/Media/PlayParse/MediaPlayParse - YouTube.as
- Size 79KB
- SHA256 cbceae216081fd4d53bb101f3480638694944c519e0b9c4a74508f5708d2f3d8
Score3/10 -
- Target GameCaptureHook.dll
- Size 381KB
- SHA256 6c8514e4f3a433ed68f31106d3f5d08336dc8bcb583ad90a77505a7db158a436
Score3/10 -
- Target GameCaptureHook64.dll
- Size 425KB
- SHA256 72f5494925adf61307a8dc25c8264682ac66cde7f93d245fcefc8a7dfa339c43
Score1/10 -
- Target IconPack/OldIconPack.dll
- Size 1.5MB
- SHA256 cb6371eeca561bca41e7c582ec67f9cf928064b9b3c775fbccc793eb0720665d
Score3/10 -
- Target IconPack/PotIconsNew.dll
- Size 2.5MB
- SHA256 b76bfeffa667b7bee1aa03dd78ec39af5c3dd80579d209eb49e5b0f7721bd48d
Score3/10 -
- Target KakaoUtil64.dll
- Size 3.0MB
- SHA256 d2c73692038145a6dd2e490d6c05d9999ebd15efe3f0583e7f4ba4e6c31c1f73
Score1/10 -
- Target KakaoUtil64.exe
- Size 3.0MB
- SHA256 57047116932a81ec237dc7055891241e31f1b7a904b127f62be8b2afe702f350
Score1/10 -
- Target KillPot64.exe
- Size 89KB
- SHA256 00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5
Score1/10 -
- Target MediaDB64.dll
- Size 3.8MB
- SHA256 7c2eacd51a765abec55d13c5d1a16a825c6e8deb36de38283ed3d72ae8368a04
Score1/10 -
- Target PotIcons64.dll
- Size 2.4MB
- SHA256 94cf9b2f2e4f0cb6bc0e201eb46a02af050df2829c1a4047e11b8e5fa6c26d0c
Score1/10 -
- Target PotPlayer64.dll
- Size 14.1MB
- SHA256 75d6347c59aecdccdc1112b0c9a3bec55fdfb3595b7ef80694f4df2bfd4aed2e
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target PotPlayer64.exe
- Size 249KB
- SHA256 503334e36afd58d45612c323958a91ec295f0b98757902e54287106677ec6126
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target PotPlayerMini64.exe
- Size 247KB
- SHA256 a659bb3e4be478c5788d6a18ea8f7097c09170eb31264c95407a1cbcc751640e
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target PotScreenSaver64.scr
- Size 241KB
- SHA256 69827cfba96cb2a9874d01d998f6109132ac3d04cd3e6f3b379dc67e35be7f51
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target WebView2Loader64.dll
- Size 162KB
- SHA256 462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf
Score1/10 -
- Target d3dcompiler_47.dll
- Size 4.0MB
- SHA256 e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
Score1/10 -
- Target ffcodec64.dll
- Size 41.6MB
- SHA256 6698cdfb1d75f44cfea0fb543201357cfd54427fc4b89e37f6fc1e2cfc1a9f7f
Score1/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Tasks
static1
Score
3/10
behavioral1
Score
9/10
behavioral2
Score
1/10
behavioral3
Score
3/10
behavioral4
Score
3/10
behavioral5
Score
3/10
behavioral6
Score
3/10
behavioral7
Score
1/10
behavioral8
Score
1/10
behavioral9
Score
7/10
behavioral10
Score
1/10
behavioral11
Score
3/10
behavioral12
Score
3/10
behavioral13
Score
1/10
behavioral14
Score
1/10
behavioral15
Score
3/10
behavioral16
Score
3/10
behavioral17
Score
1/10
behavioral18
Score
3/10
behavioral19
Score
3/10
behavioral20
Score
1/10
behavioral21
Score
1/10
behavioral22
Score
1/10
behavioral23
Score
1/10
behavioral24
Score
1/10
behavioral25
Score
9/10
behavioral26
Score
9/10
behavioral27
Score
9/10
behavioral28
Score
9/10
behavioral29
Score
1/10
behavioral30
Score
1/10
behavioral31
Score
1/10