Extracted

• • Target
    Internet Download Manager 6.43 Build 10.exe
  • Size 19.2MB
  • SHA256 3655f4cf37be7662c826bca816d48653144b25e67308cea7dfbe310ef143798b
  • MD5 e173954775cdc9a6bc4291fc496881ea
  • SHA1 e2faaee5091467f1d4b0b9d43f48ade15db320f8
  • SHA512 8495710bd07582419e0025da9c57424e9a77ec73a7941b34d91f101cecf323920626923f6a91b47f66f88453526bd26145c209b74ba0ca0d2439c1a7c21c3e0d
  • SSDEEP 393216:kxR5WgSinkkOW6CpGqkn/i9WaF6e+p9eKV5f+CxNJNCdSexYDhHCpn4Z4fkKpw1:kR5WgSi1OW6CpGqX9nb+uKDe0efp4Zue
  • TLSH
    T1C7170121768EC47BF16115F01E2C9AAA921CAD360FA184E773DC7D6B67784C31636E23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoverydropperexecutiononyxc2persistenceprivilege_escalationspywarestealer

  • Family: OnyxC2

    OnyxC2 is a Windows backdoor written in C++.

    backdooronyxc2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4