Overview

overview

7

Static

static

3

Primordial...64.exe

windows10-2004-x64

7

Primordial...64.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.ini

windows10-2004-x64

1

$PLUGINSDI...ns.ini

windows11-ltsc_2024-x64

1

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...al.ini

windows11-ltsc_2024-x64

1

$PLUGINSDI...er.bmp

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

Primordial...er.exe

windows10-2004-x64

7

Primordial...er.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    Primordial Client Launcher-1.0.4-win64.exe
  • Size 2.5MB
  • Sample260813-cbmccaxzew
  • SHA256 ff3767d58402f3e03c1a604195075247acb1bcc3ee14ee7d1f98fad060c6f28e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Targets

    • Target
      Primordial Client Launcher-1.0.4-win64.exe
    • Size 2.5MB
    • SHA256 ff3767d58402f3e03c1a604195075247acb1bcc3ee14ee7d1f98fad060c6f28e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 15KB
    • SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSIS.InstallOptions.ini
    • Size 460B
    • SHA256 83bbf3a3ce51ace6e7002cf31a1e5ad77745604a2f260044e647c36225068a31
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/ioSpecial.ini
    • Size 211B
    • SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/modern-header.bmp
    • Size 9KB
    • SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 25KB
    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      PrimordialClientLauncher.exe
    • Size 5.7MB
    • SHA256 c9f661be318e597854f5d042d0566e192460efd5ff04b50153384ac3b77a34c5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

MITRE ATT&CK Enterprise v16

Tasks