c35acac4c539d82098019b24757488579343c1a2e054c96abd3343635534a8f6

Sharing

Copy URL Twitter E-mail

General

Target
EmoteLab.zip
Size 143.7MB
Sample260814-gdtxeswbla
SHA256 c35acac4c539d82098019b24757488579343c1a2e054c96abd3343635534a8f6
MD5 93c93a501bd08579cc9159ba5bebc736
SHA1 c50e172f31e65a1e83d02ff91ec37d1af523388f
SHA512 b6e2b791655187461707266314a5b60d810a60f5eb98ee81c65422b2a47be73582de0bffb6edcefecdf5b6eb7632cee353dd86e78b9f0e9687815ee6be8ae744
SSDEEP 3145728:S2M42UGLzrAmj8YjZOGwb8InE7ueI3SYPRSejGkXi7Z/Ykp+Z8XCi3JAMgu:i42UGnhvjZOGdq6KQaGkEZ/YkUZ8XCiV
TLSH
T152783351A39B1A4FF657F47399F1D8141EA2E02790ADD0B3021AC99B0F173A643FDB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  EmoteLab/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  EmoteLab/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  EmoteLab/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  EmoteLab/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  EmoteLab/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  EmoteLab/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  EmoteLab/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  EmoteLab/_Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  EmoteLab/game/D3D12/D3D12Core.dll
- Size 5.6MB
- SHA256 31f364f2b3aa1753e7ba9ff912d0721c8f424be5fa14503efddafbb30c635d3b
- MD5 f2ba8763a1ef9857c4d4b7cab5631edb
- SHA1 296b7e537d6e986a2e4021834fad3334867acf3b
- SHA512 44f272560e1dbc282e70cb07c87e95ca3a7ef41839ebd20194fc411c67626e9c54e6f4b261aed3670dd21c6829b56ebdd0d28319207834a236fc462f97d4ce91
- SSDEEP 49152:k6PExwEh3ElnqHtuNfXlOunv5YcoqqjThYiwQF0Q29DgUOkpiq0SpTqJQEnUR034:1GYNfC50LRgg1x
- TLSH
  T13B565B47B2E942D8F1B7D17D8FA74A0AF6717421632097DF12110B9A6E13BE04B7B3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  EmoteLab/game/EmoteLab.exe
- Size 652KB
- SHA256 006f649ad7841d7a4525df701431b8b89f1b05010af27535ca90bd2ba1650dad
- MD5 3c791665e56dfd6134eaeacbeca63e6e
- SHA1 ac104f4fdf83326e5d747bfb4d0b054d01a304b3
- SHA512 a39bc85c3f3657ea889916439e87b4611add35c5f60794ce528ad549f260ebad900070bf5f873177630ea3f5609231580b15d613ade1b085f9bbcfd19a6a1fba
- SSDEEP 6144:jaMjvuUwZprUhLtXea1kMR97is8WUUTG6z4GcJHL:jtVwZpYhBV1kMzM
- TLSH
  T193E43D9101D1E1B6F755823EE01360FFFD32AE72E429266B05E07E3839779AB4D12876
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  EmoteLab/game/EmoteLab_Data/Managed/Assembly-CSharp.dll
- Size 322KB
- SHA256 10cfcebca87f55596936d4502813542ee0fd0d8d5248d5de5bed327abc061942
- MD5 6c63ed10739438978a05091a9c0661f7
- SHA1 607abf1582942532a9ecda964c580509940d0ca2
- SHA512 7f772fa3cc1d89551689825ee6fc7561136388dccd163aa0c694288aa0e18080b1ca02137802b9ef832b05a12198ca55163f13555a439d7ae6e2b45f5d85ecf9
- SSDEEP 6144:yzoIik7e2XFVqFWL4IIA5A4a9pRUaHEC:ydik7e2CFWL4IIA5A4a9pw
- TLSH
  T1DC64185067F84625F6FFAFBAB83445408B72BD13E8BEEB5C198890ED18727909850773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  EmoteLab/game/EmoteLab_Data/Managed/Markdig.dll
- Size 453KB
- SHA256 62e32097a17a1b52728c605bb4c65b5ea5690dc3475f26e31d3592715dde4302
- MD5 bd95362a02a56101845e96155c929898
- SHA1 d14a316d8085d9363811a45488a66f16b513368e
- SHA512 3e453bbfc411118986ba5363598e5c36617ba3815c0945970399c2071c76fa1d82ab75b878ca5a5eb239b8d6070ee78fae5e7d5cc6513861168147eb595006b9
- SSDEEP 6144:QTHAq/uyZr3PvY2b8/8+Qu2N+qM8JcnQA1KGV1PIayDNoqKEPbBgOn:QTrDrfvY5d+N+q15BgO
- TLSH
  T181A4073013F961E4F1BBFA36E8F2065055B2BC5BF906C69D884D748948B7B42DE22673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  EmoteLab/game/EmoteLab_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 51d4a2000119027259416d0511a1d1bec6f1b0952d64e910fe35d5bda35cb76a
- MD5 0cf02eda62e89a3b92fa62a591461935
- SHA1 1deaa283c99e695332858388dde194f47b592cf5
- SHA512 61bc9650aa657bf184117ae935323a51291383a35b80057dbe7f3d74047fb29795c5a3fad1933319dc032a469bf92f3ac69ab5fdff382b4693179cc6d384d5e1
- SSDEEP 6144:QUjTQ70cnf8MoVRxS9iJdBF119RJXG2yU+Q:xEiH119RJXb3
- TLSH
  T19D344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  EmoteLab/game/EmoteLab_Data/Managed/Newtonsoft.Json.dll
- Size 675KB
- SHA256 a56146202232958f46bd6a28b5a7da166aea123ee0d646735a46e5c341dfbf1f
- MD5 d751086b7423fd5580b5e909b06217b9
- SHA1 c1707b17df636cd6d4a804361fc6ead4ef9db5cf
- SHA512 86655b59ad62664a35a30807cce7dc2c2be8f1ece235f35dc9031873d255dc6f13a22b55d0386becbe927f007a14a6d936ba3861d1103af8f2fe16aa0afebe11
- SSDEEP 12288:aBNYm5IWx4AhnIqjCfP4bYaRLL0eglBmjV+0kRqQCB0jEIF:aBum5I24A5LYa5g1ByNyq5B0jzF
- TLSH
  T119E4282063A89B26D1BF6735B4304D1547FAF807F2B5EB8FA604D5E92C977A08D107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  EmoteLab/game/EmoteLab_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 ddf87a5e168e207ca145390bff37c95663771d0d651f4437d6c37e8dcae8bb9f
- MD5 497cb42daecb795a5986aa0427fc3288
- SHA1 2d7f719702859a1b152ccf160d80eec88f93d866
- SHA512 d6f787fd649409079fdc2ff1e3ed12cb15f400e4517c08a88340143327ca46ea2d3b03ae803a540c0428a1a9a52b3d78a62837cf8ee0f34072ad35a638511c74
- SSDEEP 6144:zkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:zkwkYfx8ZNCxL
- TLSH
  T1D844281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  EmoteLab/game/EmoteLab_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 9c84544808e89cd70e2e46db9245488886ba876104bb42b136424b7166f1bcca
- MD5 59230efe140f990c4571e696025581c2
- SHA1 dd73108864554405d26a435d8ba5ad550c305e42
- SHA512 8b8d3491b2eb381e61b7c95c3975952b9c6be49e51d654a2b050c6d960258eb2b76dd5582976bbc33e6c5346c0ff6edd6c6d9999650acac6e1d7fad6cd97c942
- SSDEEP 3072:CGHTFkizuGCOE/htnREcacWown5WJGL0MIeNgNe:CGHT5+H/33vJ9
- TLSH
  T1F2C3F92563EC872BE2EE177EF8B515110FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32