f8e56285b57f3b1a33533e29f9d6f20283b10605aa6b941260c088edd64e8d73

Sharing

Copy URL Twitter E-mail

General

Target
tenis-team-km.zip
Size 4.6MB
Sample260816-gyrmss1dnf
SHA256 f8e56285b57f3b1a33533e29f9d6f20283b10605aa6b941260c088edd64e8d73
MD5 e3dedfaba9af3e30cb88af5e5c473327
SHA1 8c5a5a7d14ad6faa7d1a1168c1d24d5dea2c188e
SHA512 352566e687a6399a8a8bc93276b4f73684d7dd2e1adf9ccdbf2637865857ef889f8e1ff11f56ddd48966dab54a41f084ddbebd1dd53da2d1a4650eb2dc4b49e2
SSDEEP 98304:hO3vV//gE6lFh1YoSxtRlPvEVspxZjKLXrg18sb7bEU8oDEzYK0aBfy4pe:hO3vD6Dh1Y1tRl3EV+xZjKL72lb7bEtY
TLSH
T117263386D29610A5F87F243089DC3EA1D3B610B7EDC311F759910A9694E3A85F73FE88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
- MD5 ba98508c9c8fb1681193aeffdbfa535e
- SHA1 789489f95afe79a531373099336310707f0199ff
- SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
- SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
- TLSH
  T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  libidn2-0.dll
- Size 251KB
- SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
- MD5 a356b7276a9d7e05a7a6e277b371c44b
- SHA1 d77d7b5584a73b9e5bbecba60a886edcf5d3d8d5
- SHA512 58fa422b4d9049ea3b08a2e4e7b5065086f2cc833fce581cc7135b22369a8cc4c399d4c9821e1f33dcc468ce06376dfa852efe25921d7671d5e2c9c598cc9cd1
- SSDEEP 6144:41G+RUwUos/HQQqBsDwSs4m/ukDyB9pKw:2GIUwUd/wynWyB9pKw
- TLSH
  T132447C22FFC358BAE8BBC231A4874731A7A2BC012615DF5B5318FE287C326F54D65219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
- MD5 83f4bfec7f089f4a9efd5b36690b6cd7
- SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
- SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
- SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
- TLSH
  T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  libpsl-5.dll
- Size 21.0MB
- SHA256 d1226435633f94e588dd20b6d15540dc18f30dcc3df1111795f24ef5d60cff06
- MD5 aee2774fd0ec1fbc101ca3e54934b53f
- SHA1 1a48791498a864ab3173abf3e8849f38314e555f
- SHA512 7e910583308692da0ca116a1223895904343fd25bee3aee52a9f02f213e3ddc9a844a8c7a656b0cfefc21bc364c05e640b741b24aa56d011d03ef004c6b9da8f
- SSDEEP 98304:UtxzNiAylev9XiQVHwKfNPh+gmABBJv2pG9jwvuLvdmbSa:UdiAVFXiu5VPh+3uL2pG9jvdmd
- TLSH
  T118279ED6B3C40B54D45ACB30CA2BD722C2F2F8160635D28B5BFDF6461E72B924B7A611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral7 behavioral8
- Target
  libunistring-5.dll
- Size 2.1MB
- SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
- MD5 c7c2ad785d5cd588ffbc7287a7a32f57
- SHA1 dcc9c1e21dbfc14e26574d024bde379aec839160
- SHA512 d07bd5d3b5600d97624a0f8fba46754000a5c9ae9a346b1171a7cdf7efcb38a7569798b0f2b8a4378530a8824c8f9a1e24f95e47c76c633ced04a1a8861faef9
- SSDEEP 49152:aFIJ3c3285Qfix+WoXHd6PFbE6QTVpIyd5F3dB:a+J365Qf93l6QD5F3dB
- TLSH
  T166A56A16B11FD3D8F5C9C4304E8EFBB291517C29ADA0A67FB650F32D1D3A8E74A09126
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  psl.exe
- Size 64KB
- SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
- MD5 7a682a9da479baec38d5d43a02b604e9
- SHA1 f47cfd3053fe916d078433a53c87010001de16ad
- SHA512 acab4e8eb030b14f78119dbaf2dff58cffc11ff620c608fd0978653d6db7ac4bc0df93915c676af3bac0573587b15ba2b3707f83bdbc90d3e2fd16ef7b13df1d
- SSDEEP 1536:dChgkRItz9QPtRg8NcMVPr8roUJqHWWbFE3rvzN:dcFt1S8NcMVPr8t0bFE75
- TLSH
  T1E3535C6AF34264EDD697C53491E69B71FA32B9110230AB3F725CE1301F31FA19E2A45E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral13 behavioral14
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19