Overview
overview
7Static
static
3OCSInvento...11.exe
windows10-2004-x64
7OCSInvento...11.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...up.exe
windows10-2004-x64
4$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...CL.exe
windows10-2004-x64
1$PLUGINSDI...CL.exe
windows11-ltsc_2024-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...FC.dll
windows10-2004-x64
3$PLUGINSDI...FC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows11-ltsc_2024-x64
3ComHTTP.dll
windows10-2004-x64
1ComHTTP.dll
windows11-ltsc_2024-x64
1Download.exe
windows10-2004-x64
1Download.exe
windows11-ltsc_2024-x64
1General
- Target OCSInventoryAgent_CO_x64_v2.11.exe
- Size 6.2MB
- Sample260824-t1msvaan2y
- SHA256 0ca4b75d5ba98a8bc468b51d069bd007677727ff7d3fa1beccec6294e4104249
- MD5 304f3c49f49d2410f647679973eb5ea6
- SHA1 502073626ff75b4dee26778bd44358ccf9b4d8c9
- SHA512 7b6a2223450110b55552b035e79a28c6067f86a3c24b439ca5a14adf9626f9ef3e274b604f8dbea5fd18cc7ca931278bebbd9ee7efc6b768c384864d18878904
- SSDEEP 98304:9lYTx/8hWsL9NeZNEpI4XozM/bK1gXnXXiATxoaHQmj9J9eul1b8RIiumkXr:9lu/8IG9j+ye1WiATxoCBQulVKPgr
- TLSH T177663302EEA88970D85976F47E261C5D69F5BE004572042E3AF371E626BD933EC7A30D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
OCSInventoryAgent_CO_x64_v2.11.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
OCSInventoryAgent_CO_x64_v2.11.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/OcsSetup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/OcsSetup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SetACL.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SetACL.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SimpleFC.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SimpleFC.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/advsplash.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/services.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/services.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
ComHTTP.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
ComHTTP.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
Download.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
Download.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target OCSInventoryAgent_CO_x64_v2.11.exe
- Size 6.2MB
- SHA256 0ca4b75d5ba98a8bc468b51d069bd007677727ff7d3fa1beccec6294e4104249
- MD5 304f3c49f49d2410f647679973eb5ea6
- SHA1 502073626ff75b4dee26778bd44358ccf9b4d8c9
- SHA512 7b6a2223450110b55552b035e79a28c6067f86a3c24b439ca5a14adf9626f9ef3e274b604f8dbea5fd18cc7ca931278bebbd9ee7efc6b768c384864d18878904
- SSDEEP 98304:9lYTx/8hWsL9NeZNEpI4XozM/bK1gXnXXiATxoaHQmj9J9eul1b8RIiumkXr:9lu/8IG9j+ye1WiATxoCBQulVKPgr
- TLSH T177663302EEA88970D85976F47E261C5D69F5BE004572042E3AF371E626BD933EC7A30D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/OcsSetup.exe
- Size 6.1MB
- SHA256 6dd18e9a9a922a5a40df6ff1b7a851bf012d2ab5c3dbe556732fffb20b069018
- MD5 3379547e8ebd9f7983d8ce5344668c27
- SHA1 a4965a84c6be641e7c0240bd87ee768844f9559b
- SHA512 50bff18c9c5c5170a6acf66100c86606f6d509fe858bf7c98538285bebe74b4411c3800d1d8799e9fc03659ff3570adef8a8dec619c910a613a7a6963c37166d
- SSDEEP 98304:7yPNxQbc4zDJezHiRM43256TP2FcfRXpU8Z5oankkj1VFKylhtCJWCw+q1I:7cxQgsD/OSeFcq8Z5osXAylfqf0I
- TLSH T1D0563302FAA89570D95A76F07E561C6D69F1BE004172042E3AF3B1D626BD933EC7A30D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score4/10 -
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 1a0f7da84f2eaefd5bf89058066ff12d6fdf9e06c847587dba13fb9ddc6190dd
- MD5 f5a23865d9565d4641effb667f8e73b1
- SHA1 76bcc3a439842a329ab3512b3246b016201af1bc
- SHA512 73e65b57a8bbd0ccbe0d4a2b4e907f6fff11a09b5ed8fe48d115c3cebae793ede78b14b3d5393cc64644c8bcc08294361cf149a28729c213b6bf287cda195534
- SSDEEP 192:G4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrj9K72dwF7dBOne:nn3T5KdHCMRD/R1cOnrj9+BO
- TLSH T190622B55738488F3DBD2003E785237079B995565B4929ED2CE275FC6687B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/KillProcDLL.dll
- Size 32KB
- SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
- MD5 83142eac84475f4ca889c73f10d9c179
- SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
- SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
- SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
- TLSH T126E26B21789406F3E69D553275D56F27562F6A5116F18883CF3399EA2C322F8B83B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/SetACL.exe
- Size 601KB
- SHA256 4efc87b7e585fcbe4eaed656d3dbadaec88beca7f92ca7f0089583b428a6b221
- MD5 1fb64ff73938f4a04e97e5e7bf3d618c
- SHA1 aa0f7db484d0c580533dec0e9964a59588c3632b
- SHA512 da6007847ffe724bd0b0abe000b0dd5596e2146f4c52c8fe541a2bf5f5f2f5893dccd53ef315206f46a9285ddbd766010b226873038ccac7981192d8c9937ece
- SSDEEP 12288:3G2NBTh+l8gAqAbdsuEa3nZGSebY7o937bfJ9Ud:3xNBTYlaLdaynZGBc7orbJ9Ud
- TLSH T12AD44A56A3E901B8E0B7D1788A674912F77A7C4907759AFF039102271F27AE09F7A730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target $PLUGINSDIR/ShellExecAsUser.dll
- Size 43KB
- SHA256 a7dae4ce70fdba99f1613f7a60204f25357f29788f7975c95f1cf3a36f0b1436
- MD5 88ace856fca877c08545763720b9737b
- SHA1 9fd256004fb12fc7952f96f2ba630d2b59fc7fb2
- SHA512 859cecd24fa4205858aa252dfdbf710a1a9e454fcb9687e43e8ed36244635774625390541a5abf836f2324fd38f1337003f33b7fede838549ec57ca10f0dc733
- SSDEEP 768:xBNMNHE0ERGh7UJVCZSc5hd9NpkkVEDJ0nS4DAGi48ffB:feJE0Es1fdNk+SD48ffB
- TLSH T18E135C0072A0C477D57A263444B59B625BAE7D026BF080867FBA17BE6FB02C1973D367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/SimpleFC.dll
- Size 177KB
- SHA256 f0c87f14da19606989f6c2e9908ce9c331298d785ad640031770ce3e71b49bd7
- MD5 64a25e07b5570f4159fdd7f0413e007e
- SHA1 71094bd79d8da849e34bffc6ee7e27078b76ebdf
- SHA512 30d89cd40adb580a1e9494f5da15a83c290ca7a3765e43ae998fb3493e174f3c76c976e68dba9c6836e2bfbd4ba7b70a56410a10232628c67b7ccaed8b045506
- SSDEEP 3072:g2sd6EL5zW/WN14wQKlLnYIUocirjM4CTsq/EULUv8fEDi+IDYUb2kUzb1WamY4u:Bs4VIawQKlLnYIfAN/EhjAb3O1WtMIP
- TLSH T1E3046C36F2C08537D1772F7C8D9A9294642EFE502E3D281F7AE80E4C5B3D65169392CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
- MD5 c9473cb90d79a374b2ba6040ca16e45c
- SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
- SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
- SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
- TLSH T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 01d867e3a1f0aec39a4ff02fe9fafefc78d6a12390a0da8ecbf4e7da5379e42e
- MD5 200e4d67e7a08d4c92f05e31442095fe
- SHA1 1d0492fdfb7c0c8799aea7982da8b4efede7581b
- SHA512 620ab7a94e4ee965c159cc1a5f2adc2cc6616cfb738ea191eab404b249d21dd19134a314a21315f4ee2c0a75fd5062d1bf353bb75b877a61171f27f4a87cf995
- TLSH T1318171BB62A80CF3C0841BBB41D71CA71376DC702793411E98470E9A34C4A6FED2E705
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target $PLUGINSDIR/advsplash.dll
- Size 5KB
- SHA256 2722555ec1f72523774b64d25fd4c2b460000bfe82140876d6100dc4fb1f62b1
- MD5 88c3ba1802aef228541820767453e058
- SHA1 4f3aefb9e4ec27cb49973cb19bd968e54a2ba676
- SHA512 718790339e13b53553afde6968ae10cda7b47cbdbfc82599116c8b5b1e8fbba259f0ce6781908be027360132a0abe057df2ffa7072212acda96bff535e241582
- SSDEEP 96:HqNXqwK188CgAtXvZBkjDf0yf9ysrtWp2wol:HAqrg1XvZB6kYtWp2
- TLSH T14BC1B63673C165F3D32646F26C1537A387EA9432236259190AE3DBCE79A2C6BDC20703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
- MD5 12465ce89d3853918ed3476d70223226
- SHA1 4c9f4b8b77a254c2aeace08c78c1cffbb791640d
- SHA512 20495270bcd0cae3102ffae0a3e783fad5f0218a5e844c767b07a10d2cfab2fab0afb5e07befa531ba466393a3d6255741f89c6def21ec2887234f49adceea2f
- SSDEEP 96:oOYqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4L7qndYHnxss:oOYq+CP3uKrpyREs06YxA2dGn
- TLSH T1C4121A635A4455F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF431A7D3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
- MD5 0a6f707fa22c3f3e5d1abb54b0894ad6
- SHA1 610cb2c3623199d0d7461fc775297e23cef88c4e
- SHA512 af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
- SSDEEP 96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N
- TLSH T130D1097675E22EB3C50ECA353C527A2B57F8C8111B9401549B938BD238C5EB3EA39282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target $PLUGINSDIR/services.dll
- Size 7KB
- SHA256 065564c3d7e19e7dea083fb9a426dfdfeabba6ca3a7587bee938f75db5753114
- MD5 89408795f143525890bbda9281c42f45
- SHA1 bd9f08641cbe86d18c985cea5325dc2ad8525aa6
- SHA512 ba11a243b97326f6cd12f7f6f8b81e67f7e8f55b5dcf63a7e705813f85c9af1866891770077514051ce153527b074dcba2881b94bdb1925dedc81354e9a84cd6
- SSDEEP 96:XrXHYWyrDznMnpuQQQjGVw1DVjjQrFUsuL579yAwEN3sKPqg3k+9tyz:XzbcUpuQQcCSDVjjQrFDkZ9Fw+3fiYH
- TLSH T1DEF1D87E33D205F3D94D43342AA31A29476EA8305B1D9533E7A31AC468D4C9FED75203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target ComHTTP.dll
- Size 62KB
- SHA256 b3ee91fe65139771fcf66f67b27cb1589a9d20e97a802bc1be6bf7c2751086a7
- MD5 e10ccd79e2982c94ad87367da57b0701
- SHA1 bbfe1186d10cc2f7ba417e7561783f950d6a6d9c
- SHA512 0a81a9b971af29b2a8451d3a85ffe933bf72c68addf2a77b4ecde7c011f6643d5fca32be44d7c367507e13dae2a6b4dca1dfedc30d7303c372418f581ca04f8f
- SSDEEP 768:Oba0g4iN73mUJt1bmnoarmyCZCHwkBxzijF2PIiEs4kzt:tyU0oaAZCHZxze2PIG/zt
- TLSH T18F53F8D953B81898D176D670EAFA9F12CA73B8218B71C7DF0324C14E4F527E0A935B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Download.exe
- Size 440KB
- SHA256 a2bb49d6be701651685a1ea52ec92a7e7e1906c3b3031c321357299bb6f4f2c4
- MD5 9c318a0e0433c7a88e94eebdd5c61ed3
- SHA1 d5003c9295e3a80a89b238e3a204303d85a27300
- SHA512 7271258bf8e6f2d0e5d78d15066825f05c08e63dfed146e982be15f7319b2a46f35e0758467be12945538ffc33574308eee40104f461ba866e91b716c0e613a7
- SSDEEP 1536:zcqPG+0aTlug1xKJJJZKJLO4ybYFSZMwExLDgCIk/VR/z+:oH+7RujJJUO4wOwEFgCIk//z+
- TLSH T18FA46F46E6E902B8D42AB6F0BEA50D1D9AE1BE600171415F51F378CA0E7D973EC7831E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10