85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f

Sharing

Copy URL Twitter E-mail

General

Target
plutonium.exe
Size 4.6MB
Sample260823-3jsgfa1ekg
SHA256 85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f
MD5 72cb7c6d98e9e47274733825c9176679
SHA1 8681469349254c5203a7f9a189833d22a14f5cd9
SHA512 d18d306ca9a311df1a96244ecc67a3e61ffc8b9b465a1301263e11d500cc2f38847e922c57d4a3321196d6ceb32310113d7d790b4dfb2c05c3ff1e2af26dc708
SSDEEP 98304:zUaMwIBAoUcmmxVA5/xDnLx0yu+5TeRXExXYAx:Ia+AobhATd0yH0RXUo2
TLSH
T1C1363306A6A9FA0BD52432F070A5E67C45327E6EDC0A8B2D89B5306F513BF5FCC2254D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  plutonium.exe
- Size 4.6MB
- SHA256 85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f
- MD5 72cb7c6d98e9e47274733825c9176679
- SHA1 8681469349254c5203a7f9a189833d22a14f5cd9
- SHA512 d18d306ca9a311df1a96244ecc67a3e61ffc8b9b465a1301263e11d500cc2f38847e922c57d4a3321196d6ceb32310113d7d790b4dfb2c05c3ff1e2af26dc708
- SSDEEP 98304:zUaMwIBAoUcmmxVA5/xDnLx0yu+5TeRXExXYAx:Ia+AobhATd0yH0RXUo2
- TLSH
  T1C1363306A6A9FA0BD52432F070A5E67C45327E6EDC0A8B2D89B5306F513BF5FCC2254D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  controlzex.dll
- Size 244KB
- SHA256 f15d89d9720eedb94c09b1db32ca6a514e9eff2906da91396ffd7f877714911e
- MD5 37dbeb3e804d61cefed67d1a60dde873
- SHA1 31fb981cc429cd24066363160e49c85fd74df8db
- SHA512 7279e2354a9e1a583098bc9f6ff9ec05bb2b526ca151265d4c8c2bb42edd15b3d157425bc76e01b9f0e03cb1c87cb46bc94f9a1f47dc2a79daee784d6122f3fa
- SSDEEP 6144:M6bRKhjsomR8PpY82VG7gP2rxp+7vVNviPF1WANK+5/:M6Yye9
- TLSH
  T1BB349F2533E88A2AC5FF077AA4F041148771FE56E7A7DF4E19C466BA4C93702AA403D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  de.mahapps.metro.resources.dll
- Size 10KB
- SHA256 ea0ab117f8f384fc5e22b5afc52bb89ea2b2d4198ab2673636b7aa36603e84f3
- MD5 0abd1e7202d7a48aac4223daa56d6472
- SHA1 312af615ee8d9b477e5b1c9fb952eb3a138c471d
- SHA512 6aa55138f3bb6b110ad93d9c29df2067f85ee367d4c117142f95e12723a8a0aea3a1e9d585bb5cabd68c7bb827477a1144a0df7d2224097b5f2bf53f88abc3c0
- SSDEEP 192:f9GzDcHtDpvhpzcPWg3TUHfBo+6IhF0DY2ACkVtW/lRODhQkBp3ySNUt4LUtsVZf:f93HtDpvhpz03TafBo+6IhF0DY2ACkVv
- TLSH
  T1AA22A561ABE01768F2F70B796EF7606A1437FE025F29C2AF819091491D32754DEA1B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  mahapps.metro.dll
- Size 3.4MB
- SHA256 1f3c694ec608fff224e98fba810fe70adbc7e470f56ab617be0b812c5b1113d0
- MD5 7b0f105e6d64d4ee914d5b48ec9bbe75
- SHA1 34d69cb025f1fde595b0670e59b0ada7ec074dba
- SHA512 e61dcc0a25d542e265be904693363c989e952126bdfe9fc9ccc1c95a0d765dd67970bba2e9d971d796cb4cfa65ccbe54a28eda62cd4853c5eba7fb504c208037
- SSDEEP 24576:prXx6dKYH5UHXfMvbj2OqhOV7qDL2P/1Y5e1bq7mTv+iruHt+j:+D2mM2bq7mTv+iruu
- TLSH
  T1D2F56424C319C437EFA35E751F5098E41D2028E98342FE1A2BFD2B3588C575E26BB967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  materialdesigncolors.dll
- Size 295KB
- SHA256 bc108791979bd3918157379f5e9a1473a807446601d2953a72d040f68d9fcac5
- MD5 af3c7f96d531fe89cba283b45dbc796e
- SHA1 f539cde0f743f0084d3fcca0526dc62d530e92ee
- SHA512 93144bd397e83f420e9ad48a60681cf4df04816cc9121863c44d5b5ad4d3cd5a4db36238ae46296782739b0ae16d5cd2b0f7a56a86da68a1f5ab2e33e0e21d4f
- SSDEEP 1536:wBuHdH5tB4AN61RB/GHHYiBNd8U7fKoVxbdsJh:NVKA80X37fKoVxb2h
- TLSH
  T16754645C1254E0FED81357764838358962277A2AAB944F8BEFAF72FD8C1600B4B335E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  materialdesignthemes.mahapps.dll
- Size 109KB
- SHA256 2e7dcf5e859db06d66890a885986c79948008b01b662905c4de468f28ce2a09d
- MD5 a0609491ff929b9849dd41cb18736bbd
- SHA1 d136a881b314664ea48ca7fb269fa748164592c8
- SHA512 c91744816ec81be76e804a3f490a3031b53473b02a2b03d5c19b8898ad36954d49ed727fdda3994ec1b4521672b4621e6e0eee980fefd7577a2e96cae23cf734
- SSDEEP 3072:/qEwrEuc26hjmDRHqkXslLTQPTC0X/ACNS85L5c5P5JFiZr/wbNkLkckPkJ4H4wz:EvDRHqkV9
- TLSH
  T1EDB3FE0033E60306F27A4FB41AF3D964057AB5A7CD72C76C61C9358A1AB6A95C636F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  materialdesignthemes.wpf.dll
- Size 8.4MB
- SHA256 7d2c49cdae4dc08953dd2c84a072996d43bc6ba9cacee6f38b2bfa474fe3ac39
- MD5 e13f88b1929d678eeb05e4ccd0fec269
- SHA1 75f083ec2075a742ea23e4cb8262ab0545a6a5e2
- SHA512 6258da433dc2ef3f61e121ef8c051f119e19ab655eef69f703853aa7324880ad7fa3dea4f5125b67ef74712594862abb0d2516c7c3b89c366ee3df4c59d602d7
- SSDEEP 98304:1fZXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCR2fS0:1znJ45/9iD54+V11bFv4z
- TLSH
  T15F96D82CD901A727E2B7C264819E0A17F1A2856AF53D5F0E30CB1B593247A437E85FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  microsoft.bcl.asyncinterfaces.dll
- Size 21KB
- SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
- MD5 48efe61d6ca3054309907b532d576d2a
- SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
- SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
- SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
- TLSH
  T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  microsoft.xaml.behaviors.dll
- Size 141KB
- SHA256 ff75938fedee596706171916db763ac100bc7164a7346dd739ad61660e068b5a
- MD5 6b93b0f937d04d39172f9cd61fe58fd5
- SHA1 54fb26f8b4f11d01573fd1c6a1b532af2b37d687
- SHA512 d3b7bbb09842984147b8dc849ef7467c3927cd8730ccfcc310d6d46bf3070e826d7a1cffc43a2ccc33d5d8521ea07d2c19d766b127fafc71edcf288db187df1d
- SSDEEP 1536:CClZTaFPgnGNXRhJbyC35MilASMJmF0bapI2hJWq1dwpUgcacykfwtQsxspzSUMj:CCPmFPD950+dzR1decbMn5TX55r4j2
- TLSH
  T168E3396423FC4A2AD7FF1638E0B851208235EB97B562EB4C5EC591ED0563781B7123B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  plutonium.updater.core.dll
- Size 18KB
- SHA256 a38110784b3a667df5fc0b3f8f915aaa136a5f7af82cefc202edcc345fccfc59
- MD5 6d6fcd03e844b8234755aa2b495910d7
- SHA1 526ab4fb4ec38584c0e52e4d4b2325a3f9d9d750
- SHA512 5b3e184827fbaed709c6d8628e0ab51fa8f51c70afb117c2c28ba1332b7ec883e7f14e0be6fe49986120cca4a7d8f413d5a0b03e4caf76719339af6d9421e91b
- SSDEEP 384:J8Kln9MynWI+kgmZXvM61XOA12PHMEE0jkON34bY:y82mWgZl4H00VP
- TLSH
  T10A82D82AA768D32BEB5F4BBCE96953410370E10A2103EBBA5AAC75D63C173340C955F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  sentry.dll
- Size 487KB
- SHA256 d0bbef0f9270234c905b1df71b7d18ecc54295df65f2972ecfd8d8eb316526a8
- MD5 f9f241fac34e7099932fa63773433350
- SHA1 01605e954af743e823b7c1a379cca973f8cbe314
- SHA512 94e027d8a684758ba3ef1ec02e69036e2ca54df26e854b0e123f542da054358f7cba459ed71161c8d899a422f1f126a7556f0c57eb83163039fdacaaf6700767
- SSDEEP 12288:vJQX2m8QkrcaV746S6eBzi7Xq8GckEB867P8T/D+mv2:vVfYaQi7avckEB86aq
- TLSH
  T111B46B4643FE4729E2EFAF35A07894050FF2F947A869EF4D6A48A5DB1D937429800373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  system.buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  system.collections.immutable.dll
- Size 184KB
- SHA256 646d3b52a4898078f46534727bdb06ff23b72523441458b9f49ecc315bf3ef5c
- MD5 c598080fa777d6e63dfd0370e97ec8f3
- SHA1 9d1236dcfb3caa07278a6d4ec751798d67d73cc2
- SHA512 8a5b4afb4363732008c97d53f13ee430401e4a17677af37123da035f15f9e9409a2aeb74ae238379291fd5de07c3cd4e3de2778da5edf83a42649fa5b281cb32
- SSDEEP 3072:MHutEkGE0frJeOAY1tn/DuunP0F9QFg3QuxvkaHFckod:eu501WY9/DuOP0F9QFgwkm
- TLSH
  T129042705778CAB36CEBF4E77B49590DB8A71C217A096F3AAA1EDF7F14483351AC94018
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  system.memory.dll
- Size 137KB
- SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
- MD5 6fb95a357a3f7e88ade5c1629e2801f8
- SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
- SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
- SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
- TLSH
  T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32