434664ea764a0976dfb7651c2262da58ac4c7013cf56f3c000446c382772b4b3

Sharing

Copy URL Twitter E-mail

General

Target
LCC.pima
Size 9.8MB
Sample260818-e8645aw1aw
SHA256 434664ea764a0976dfb7651c2262da58ac4c7013cf56f3c000446c382772b4b3
MD5 e65f9d3de5602d8f9cf5bfdb99d2bb29
SHA1 5b28e5fda4aafcf0fb1848f5e0b4e6e98349c48c
SHA512 42dd97c45d9bc59e89c29468f707d75fe30247bcb09549687aa1f441b397881151bfa195f1195da712f80041a3acf36f20dd237553b9104453f13c6ed2829ba9
SSDEEP 196608:mfK2xKN1uU0rTzUDl8ShG/SDjTv0xs+e39jZbumDOGM:+K2xQutrTzilbIS3vOs+e39jZbulGM
TLSH
T185A633C4E872E0656878A362E3D4963AC6138177EDD70D67A0B787EA96003C43DE6D93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IMSLib.dll
- Size 2.0MB
- SHA256 e8d4cab160e3fb2c3234e19af0cdd4d75135e34de00899c16e5ba574b515f028
- MD5 add5272bfa6d648f099d33757624fca9
- SHA1 8f6f30b6808ab97ea951e654591d70cc38e38d36
- SHA512 ce28ca3eb31cb2708f611ec036041ed74fe4c63a499ff6646bfbffcd5704ba95c8444032bc9ad6a8f34c6f792841ec8b75c987d985ae566ed6969547851463ab
- SSDEEP 49152:XAWrIt1K1KwPGhPff37TryMt0x5mUDuidd0Iz6T:XQK1K7hPffrTWiEmUx01
- TLSH
  T124A59D22B6C6C036F5EF02B4657A5BBE4C3AB918073485CBA7D0286D5D305D26B3B763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  P7Native.dll
- Size 2.2MB
- SHA256 6defa490e48828aba9ae05c9262924dcf9b0cf42c1eba532e3ac26ec01ed89b5
- MD5 2ee7d6208279ec0001e56266ea49433d
- SHA1 3cc4df18d0b281f83576adb13db595e66be5d6be
- SHA512 b50ad56009e780b201d0c6f85aae98ff46fa0317c1557e73430b970877546326079a17bca3295443fa5c1ec7d068c0f9297e28ea18ce30ba3a81ca2c1f6c4266
- SSDEEP 49152:gXfPVE535XT7UoK15t3C9EunDH3FCsraATJ9rePdSHug:YfPVMg15VADnDVC5ATGPdQ
- TLSH
  T1F8A57B12B6D1C036F5EF02B0527A5BB94D39BD34173881DB93D42C695D30AD2BA3A72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  VulcanBridge.dll
- Size 277KB
- SHA256 45b30454a1e9886237095433027eb1b19c0e8a135667d74808d2e738707533ba
- MD5 251ca5cad17b96aa07389560b97fde70
- SHA1 f278041e61b11a9f1b13ca6e9a13697c7d22fa96
- SHA512 b4072261d8cb0a185620cbe2fa203525e9703122db29095e9a05c79a1fc562bba352f73acdca997f96e011b75dbe1203debafb752c1993479f46f66abfabfe6f
- SSDEEP 6144:KZWm6F2ZlKkDOFYRjfcL5iNWcAOUOLZrz:KZj6mZDYYRbA8IcDV3
- TLSH
  T189547C11B5C28033D4BE1A344579E766097CB9218BA4C9DFE7D80A2D4F722C27A36B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  VulcanMessage4.dll
- Size 301KB
- SHA256 43ebaa2c820f5503164d105a0fd24d230ec7103388c3f262d039f5fb1b950376
- MD5 dee66ab932835c55c345cd1c85e3fa0a
- SHA1 06038230bcb335712bb533b1ec74e20363496e4e
- SHA512 5c448e34ea4094ff5ef75ab3a9b92f14db27d5f5ebaa0568313b5c18861ee40087b4468998ca3a94f51b13b222abc219c679dfb848a3ece4a31230240d57e96f
- SSDEEP 6144:NgcCzSIaW0tRTgOEztP39ydmu+QqoIVYOtpm4EqEnz8ScBkE:NzId0tRTgNz17u+wIV7to4EZtbE
- TLSH
  T11A647C627541C036C59B1375A4BCE76A4EADB8116B6098CBE7C809BECF306D36B3534E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  VulcanMessage5.dll
- Size 945KB
- SHA256 00ab230f21c61660910787ef8334eeaff7646e0d311bbbb47ac169b6065f2c9b
- MD5 c35e1e73dd0f4fccf5f6d628d57bf2b4
- SHA1 d3771e3b9962b771e925b359b2d8e6c20452e37e
- SHA512 c459f985687b9d723eb0a447f2818a2990a2dc97e79f24bf5cd9d65ae4cceecf6f87f4c35663392603f29b57c370056b532acd3565afa19283f29d840850f09f
- SSDEEP 24576:/Adav2wLCWNLVcquoQeFl0YXEUMmRlp2gNPlDGAGm0ZNAPLTsOz:/bLtxVcqQeFl0YXEUMmRlp2gllDV0eTl
- TLSH
  T18D257D603D89C132CBAE11714D7CFA6A14ADA5200F3445CFA7CC2A7EDE785D26B3265B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence ransomware spyware
- Modifies file permissions
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  adobe_licensing_helper.exe
- Size 2.5MB
- SHA256 689dfd5da48edeb9cb3e6b40b12e6ecbb10ceb7eedc240fd512d80f8beb1bc0c
- MD5 24bf65722d00ef2b91359a21372c8676
- SHA1 c8323fe0d0f6fe01b43794449131eb6f6e82f4a8
- SHA512 21c487dadfcdac5cd41c61b3f83f7f5d24c0dab8153fe77b9b4d24777fdc9decaa2aecf5d66de043ec6b7263502375cd418d67fcad8726a16c143c0c3f2c09aa
- SSDEEP 49152:w5D8lMG6PrAw36vjwNpQjvxynanf7NAhwgrm9EMK/23qdDFKLqGrxcfn7V3ZRld1:r90lZRbM8D5D
- TLSH
  T195C57D753218C9A7E52154B569687B4A402CF8B4D7A208CFF3C03D6D72789D3A93B72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  adobe_oobelib.dll
- Size 3.5MB
- SHA256 042098b75b361ed574a09887d523225fb95bb1ec92d843d1c068a75ea2a47e41
- MD5 047417a4032366f6b8277d80396422a5
- SHA1 4b600fc02b80d54aa6e84664d424e89d3ee19963
- SHA512 8fc35b0a0badadd074508f91b28ee643f6942cac7f0645d10c1702443acdc504e2c9e64d5d2a5e942dc97fe613fc0f958663ace977ecc06bfcd6ccf6554b83ce
- SSDEEP 49152:zkxmmZU9/G3NzgFLzskklUNseIRwGvnnodtj9ArkpKXzK+CvLoLQpEp:wxmqO/GJgFL4kkgseIRpvnnodN7sQ+
- TLSH
  T161F59F21B642C132E5DE01B0A57AAB7B492CA9B9133445E7F3D02E6E29705D33B3771B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  adobe_upgrade.dll
- Size 3.8MB
- SHA256 57cc14fdaaed0e08d2c8c0e6b094668e5b0c9f42d56e436b2b36fee659aa7184
- MD5 2a64c2afe1bcd1f9ff385d836ebb574a
- SHA1 2b6736bb53f2125e5c1b4ab65a3d47e2ea323651
- SHA512 f336c9a0ff2985eae7410277dddbb20df0f765260971c22c2d36ce0a0f2a885263d40e59b7a6e9537873381b2821f02b901412c6a2663a743c361d284215a82c
- SSDEEP 49152:Bsbv9p3nSvRuGUdbSwAtx9F1rNrvCCS6ZlJxvsQcsReTqgcG4wE/wf6KYejgGoVe:Ba9pvdbSVTJxvCCS6jpt/K6KYrc
- TLSH
  T10806AE21BB82C132EDDE01B555BDEBBF482DA6040B7449D3D3D8196E9D341E22F3B64A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  imshelper.dll
- Size 1.9MB
- SHA256 e85cf245e21b448c74609d3c3a770a9ac0843185d0084e40ffa92e3550403b9b
- MD5 c2be5a0d491cbaf258e4d0e2f6255940
- SHA1 abecb8945c01839e6e096a0eec05389ded020ba8
- SHA512 d762772b9ce7107e08d5fa0b5eb77735147c7fb9ec3cb3db7aa64ec69706a36924e7ba76d920fa0f249e3abad05b5173627bd65919409efcd15ddef51cd1b172
- SSDEEP 49152:bZXnrekX1xyWK0lw5XHR95t3GDqY52YutfwywKNBgiaYf4Qk3RWKQzRCrtteQIV6:tX/VUPLyWKsQ
- TLSH
  T17F958BA13A08C263D27F127DA9687B95606D84F53B502EC3D3C52E2C25791E2DEB7783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  x64/IMSLib.dll
- Size 2.7MB
- SHA256 ec010c4a12cb28d61ec2ac2b511676f76f56b20e03fd8656f2d1f86d8a91b6ff
- MD5 5a16649ea7ef6a8a4ad2bd162ecad403
- SHA1 40bea664909364c391e6efbbb3bdc81ffe837593
- SHA512 53166fea32d5324ea4e5752bb73171c8f183b3a55ffbe0178014a9a209aaabc9415a812c103804ae43db07a9f700e790bb2f188d62b4e866d4098f547c38691b
- SSDEEP 49152:2JnG+Tha791oLblMqQSA98CK0tQupz1oyGrVc6uv5tUa/:OG+TMe3XQS9ubX6G5j/
- TLSH
  T1EFD58C16ABA840E5D1B7C2789A778607E7B1B80417B0DBDF06A4426E1FB3FE0167E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  x64/imshelper.dll
- Size 2.5MB
- SHA256 17f9395ba30403ea1bfe240b458a1532b874a796a834a7d5ba771def68aeadc8
- MD5 952013975a28fbda5722345fe4cba1f8
- SHA1 f1a8d3785003e13ca823a46a01f5fa4f6d893fb9
- SHA512 535bacfd4e2825b1d99a02ff2119c26549ba9284148e01b2c656ba5f6c988e0f1871f0b28f69bc26469f6d723f7d6261fb9e514280bc45613a89f01eb5d14495
- SSDEEP 49152:tV/PatLXv/MC59Y9yRk3MrJQauqxOeXfkY9zNlEwxt4C:tUMC5Rk3mOkxTbEwIC
- TLSH
  T1FAC56EAD769842D9CA63C4B8C8129A86F72171258B315EDF1261132E1F37BF6437F9E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies file permissions

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22