d13a52f7e74fcd5422bdde25706b5e246284fd3af99b66d98b11dd044c69d5f2

Sharing

Copy URL Twitter E-mail

General

Target
win-x64.zip
Size 59.8MB
Sample260818-mlq4ds1aka
SHA256 d13a52f7e74fcd5422bdde25706b5e246284fd3af99b66d98b11dd044c69d5f2
MD5 22f9b0001a445e758b3c0dc22423390b
SHA1 dbe89e5c03b286611f00cbd3c3404f9fd078be6b
SHA512 6bc43db0d9970ba3530731767c9545c240cdef778f51dc8f4e1778627d4c7284e85d835bcaac8a592bd92f7187da3ffb13d8b036ca104a3f29acbac03ff7c759
SSDEEP 1572864:jqmLe20RYKdGCMx9bgWASmHPYOpaKof10WBmjVBimZNwCVwOX28RIXWN:umoZdGCMx9bgWhCYOpvw10WsZBiXCqOV
TLSH
T1B4D73362D85D35C7CE68B612FA4FD538DEF5E77B04A4622340CEB012C1CB6265291BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  D3DCompiler_47_cor3.dll
- Size 4.3MB
- SHA256 21df5696011156fe64f2dff47c8ed5e90817021f91f70b6d9707fd58cd1b0b81
- MD5 9b1148a147fc307a501e8c540048991c
- SHA1 7bbdf247051937141121ae6132b0d4f2458ae7b1
- SHA512 e06185401efcf84d2be23c0afefd241eef89414f68133c99cbc67d55d865ca9aec24f94b735afcbb5975fa2f2e56118a8a980f1473ebd248b265dee477111ee5
- SSDEEP 49152:NYlc/2200PiMLKam+VMrLi21f4i3jn5ZO3KUDmOZQwGuHuQpN3WsGVUWd55i/jr1:3NKD2Mrda3xVNQSljrx
- TLSH
  T1AF267D5677A841A9C27BC178CA574303EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  PenImc_cor3.dll
- Size 149KB
- SHA256 1b04754f964c7fd01751a0838bfc1ff80f771235d0ff873e12c022a4e1bb0982
- MD5 efa8b1beaa1efec9ab4e8294e10e503d
- SHA1 fe768525e1f2fac89ded45b5acb0840a4278ba9c
- SHA512 b97070d991925d1442024ae9624270f9ad75e30f0e8ef5f32f685c1d5bea4a2ef32b7e04cfc4168d945ee0d6f17c7a74014b1568bb08fec315c88ec7f6f4fe5e
- SSDEEP 3072:xAWjDytb9rZara9/+8wbrUuEej3FvAyaoeIdATZ+bqAY4o9:xAWjDm9Wa92JouEej3zOAs
- TLSH
  T1C7E35A177AAC80A7C069D23988D74545F772BC111B228BDF22B4932E1F3B7D4AE39352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 b38edcf69d26f4f38adcbcc16efac6bcdc82982de75d0ea23f52203ce14104b1
- MD5 868a85bc8fd1312896c9bf4a0601720b
- SHA1 a57ea6cdaa3258852b277235b78b007d8c8e994b
- SHA512 72754870b744a3dcecc195c876d584067d4b7bff6e37c0be523111f8c7ad8872ec950bc21a96858c1d5efdd001520139a9923e72666e3076536e70127da8ffeb
- SSDEEP 24576:n3OmJgMQJLrx29O5HaxmIpmCIu5JlRMcLWBhD4LMzOePWtaYBGNbZhQB2VCepZCJ:n3OhMQJx29O5HfCIudRMciPD4LMzOTtH
- TLSH
  T1C5453A72D2E642E4C47FC1B8C646972BFBA07449231C66CB47608B592F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  WPinternals.exe
- Size 129.9MB
- SHA256 860aeeffeef534525084957d8d7fed53aef52fe550ae32e926cac89f13993d88
- MD5 27d4a4118ce210b0c0e580bc0558b93a
- SHA1 a1d672a0734c688ddbfe24ceb9442156f9d74c1a
- SHA512 484f79ff41abe3ea44776e9267cf863fb556611648e52d8b574240401180aa4a2ccce81548f827c7f476df9ac65588434f6b802449664f28ec35dc2d76f5f0e2
- SSDEEP 786432:gd2A8qK7XSPyo0zZ2LubqsVaIadAbjdMu3G8pfwC0X:gdd8hSGSknfrbxds
- TLSH
  T12C587C01A7E81A65E0BB4234A77395A1C6B5BC961731C2CF1444FA4E2D73BE27A36337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral6 behavioral7
- Target
  clrcompression.dll
- Size 731KB
- SHA256 49f9a75ec20c3a40c73ebccc008ad82c27e63db79e84d00e6132cd9727fbf677
- MD5 5b792eca9dca0f9b3e8fcfae0cff23a7
- SHA1 5af12b98aaa2668072cc7196e160db3df822b914
- SHA512 51feb970ec703a5e9713b2ac4a09b324ad15c3266cc75449aeb872f7a175d971b692769d44901fbca4210ffc5dd360ff13e5073dd8ea50626122cedd42997d26
- SSDEEP 12288:ZRuWUDblAAQIi1T1KPAHhlyRMh8rXTw05nmZfRZ:ZLUDubTMPA+pwAmZfRZ
- TLSH
  T185F4BF47E6671336CC2B9078CDA76736DB3633B4426044ABB19C55653BC3A2113AE3EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  clrjit.dll
- Size 1.2MB
- SHA256 3f9b09169741e045f5a655dcc910d4d32d7d8937617ac82300681fcbd1e7828b
- MD5 59596a272009239a84c79938890f0d33
- SHA1 635d1a1ef91249f44efb7d0a379a0c41f43ea942
- SHA512 78ff876154ee907e64d984d3a0c16392616c7005c6dd1c61109ea0ad590b8a0393c64c8664be1c1aa458d90a9a16cfd153379a2d6e87541df1d2fb7523194009
- SSDEEP 24576:hmzoi6FtJ5bmla7yC9hwAgLw/IatHjGjZBnJ8ub1XFnnun4ir/Ce9Ai3mlwO:hw58tJ56la7nnwAgLwDHjGjZTbbuprqr
- TLSH
  T1AA459D06B7E905F9D4BBA239C5138A0BD7B2F80523218FCF47E84A95EF137A1261E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  coreclr.dll
- Size 5.0MB
- SHA256 327e50b959bd57bb25a5f32c37c336a3bd513dac78fa0577ac9f1841623ea297
- MD5 c07d8cd07ef8d8dc6f1ee9dfab3c6f4c
- SHA1 28b7613d4e14a6288127cf88a10e7d492835837d
- SHA512 f77c66b32e60530121ed76d09151ea89176b6879351f52853bd74a40b425d581a38cb441c5de5cfc45e5371516736ea914f691a233793cf1bf1959b9c7a4ac07
- SSDEEP 49152:+56++xcoovc1rXlIstnbtohdIo2bzqucEnT6UO2QsCica4WM8dnUov+KtiAlGVWZ:0Actv+Xn6routVlcvH1Ojcz
- TLSH
  T1D936AF56B2FD40A8D4BBC178CA934617FBB178091738EBEB466586251F23BE16B3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  mscordaccore.dll
- Size 1.0MB
- SHA256 2faaad95b87fc36b87afabb8a1ae296f858b69e264c2755eabc85c0fe77cba6b
- MD5 87d37e49732f06eeee9c1a77dd593210
- SHA1 9967ff336faf057d3dcb59cb97baa19daf5e3130
- SHA512 fce4505620451489689e5a8c80f3374109f7a52168370ab8c50eea4da7d43edca22eb1f7be7965fb6ea7360aba58ea3b2261cdaa8ad70e1cfa50473ed44dcf91
- SSDEEP 12288:9+38ZZ7cWDBrQiCZlo8850PWvNUKCwWX/cX08vxyzpf5:9+3837cWDB0i+l45Xv22W0XZEB5
- TLSH
  T177356C5696B8459ACDBAD1B9CA1B490FEBF13C04133493DB07A54A493F377E0AA3C316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  vcruntime140_cor3.dll
- Size 94KB
- SHA256 36088e4f2fe6cd911e6f72ebf58cedf6124ae7efcb6b731cf0c6d79de6b339e0
- MD5 b16e4fef572b9aa58c2aba7609d671d2
- SHA1 830be9ebeb0c3ab314c1ce1e1dd86b7bcc6ad52a
- SHA512 8c014584aab6b242e36d8fc228ff52634ce3af98e1998172f5ad537209af7956aee0501d9e3164074c79a70eab7de996c21ec5516801301208fa6546bb5ca026
- SSDEEP 1536:yuHLG4SsAzAvadZw+1Hcx8uIYNUzU7HV4xecbK/zJjIJSv8:yurfZ+jPYNz7HV4xecbK/Fj0t
- TLSH
  T1B3936A4A76A442BBD06BD274C1A24A1AF770B8408B7093CF07B6466A4F67BE05E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 f4fbd3a7040b5910e634ef62be2dfb3ed117f48758d3f97c601fb4b0d2c2e597
- MD5 57e61140c38353afd7b1c13ecb6d008b
- SHA1 14f4540c1b0071b250e4f45e61e50cd9c534d1a8
- SHA512 608e5a637f38adc9972389328c422d13d91cc7142e96799972a49fa56cc44fd5f337e15b9015c68e151c7d1137e536a0dd02bc1d131e93ce502077392906dfb0
- SSDEEP 24576:AkwoCfdEb4aU+K22lKXaHDSPBAa4FvJdh8XGze2yrTlneHjxoJG7S3q1s4By/:Uoiib42X2lKXajK6pcl2yReDxoYNw
- TLSH
  T17D955A4A77AC50E9C47A923CE9D7861FF67178102BA197CF27A0079D6F27BD0097A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19