General
- Target Creative EAX Setting 2.exe
- Size 100.5MB
- Sample260823-c69fcssblf
- SHA256 5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4
Malware Config
Targets
-
- Target Creative EAX Setting 2.exe
- Size 100.5MB
- SHA256 5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Hide Artifacts: Hidden Files and Directories
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 99.7MB
- SHA256 3be698f7444b30faa0f48958046590a646179913cab50d6f55a51c613de9520a
Score1/10 -
- Target Creative EAX Setting.exe
- Size 212.9MB
- SHA256 bd8ea114110009f462078f23fde5197923936fc9f4f7f0b11e6f177e19e43184
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Hide Artifacts: Hidden Files and Directories
-
- Target LICENSES.chromium.html
- Size 18.6MB
- SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.5MB
- SHA256 7a743a2af5b4cb59cec8c38e7fb544b87fb6547f215491634a577a03a4e83bd8
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 3.0MB
- SHA256 e7aec5ca86d80540ea30c5acdf0a13acb34d1d9dd0f9e78b36fb21776b711a1e
Score1/10 -
- Target libEGL.dll
- Size 510KB
- SHA256 6edaea2de8f6bca40dc4cbb60a55be5ae93c2454a66474c3706953b5d1d73e26
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 49c2a50a3a43c10e258eee0d58e81be9d207ebeae206d603314f1ebc36d7567f
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.4MB
- SHA256 d50b5ed41356b540e1f1d3525837effd4045220cb4efbfc2b913fd7d7edd0999
Score1/10 -
- Target vulkan-1.dll
- Size 932KB
- SHA256 35b0d20574fd7f4c8b959e4789cd75950a37cc6106119f89210d086e7f15b47e
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall Creative EAX Setting.exe
- Size 387KB
- SHA256 96d51c6dfdf484fe368b9cab0880cf400ebf8cd74b66350cfd56ed83978a47ec
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Defense Evasion
Hide Artifacts
3Hidden Files and Directories
2Ignore Process Interrupts
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
6Credentials In Files
6Discovery
Browser Information Discovery
1Network Service Discovery
1Process Discovery
1Query Registry
4System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1