33bb499ef2b6025a61897d7f004b77782c5a2ca641557473a18012286c5f97b7

Sharing

Copy URL Twitter E-mail

General

Target
ZoomWorkspace.exe
Size 10.5MB
Sample260825-wybc5sxdlf
SHA256 33bb499ef2b6025a61897d7f004b77782c5a2ca641557473a18012286c5f97b7
MD5 33afecf813bd11c17d1cfc23ac706b85
SHA1 bb86f81ecaf3f05a640196354d0e9b79a705458c
SHA512 feff27498c573d6e831d12dd3b38040b9bd5f84a062b09744404db64e208ef8ec98d57bcbf904f93f07b03f926a273b91240a2a2f80bec4bf86e63d3a9ce0283
SSDEEP 196608:IaZk+wy0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8F:iny04RT9R4PkE7Ap84p29qIT0Z6rXr8F
TLSH
T126B63313D57BCCE0CB234678D6E10A46BB4A018A9C5AB8D4F584633E55D74ADEF38B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ZoomWorkspace.exe
- Size 10.5MB
- SHA256 33bb499ef2b6025a61897d7f004b77782c5a2ca641557473a18012286c5f97b7
- MD5 33afecf813bd11c17d1cfc23ac706b85
- SHA1 bb86f81ecaf3f05a640196354d0e9b79a705458c
- SHA512 feff27498c573d6e831d12dd3b38040b9bd5f84a062b09744404db64e208ef8ec98d57bcbf904f93f07b03f926a273b91240a2a2f80bec4bf86e63d3a9ce0283
- SSDEEP 196608:IaZk+wy0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8F:iny04RT9R4PkE7Ap84p29qIT0Z6rXr8F
- TLSH
  T126B63313D57BCCE0CB234678D6E10A46BB4A018A9C5AB8D4F584633E55D74ADEF38B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

backdoor discovery persistence rat
- DattoRMM remote administration tool
  DattoRMM is a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 31KB
- SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
- MD5 83cd62eab980e3d64c131799608c8371
- SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
- SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
- SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
- TLSH
  T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SimpleFC.dll
- Size 175KB
- SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
- MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
- SHA1 99778940e059238ca23a513e717d4db2cf34e606
- SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
- SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
- TLSH
  T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH
  T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsSCM.dll
- Size 5KB
- SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
- MD5 62efa7b730eb0523a026ea4325403b77
- SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
- SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
- SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
- TLSH
  T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsisXML.dll
- Size 11KB
- SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
- MD5 13deb9a0f4e4286df01abc85e1895e09
- SHA1 3174853b32407fd85220de844b390a18a8a76c97
- SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
- SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
- TLSH
  T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  AxInterop.MSTSCLib.dll
- Size 240KB
- SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
- MD5 0f581e56ed5ba500ce5d98d105b04a37
- SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
- SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
- SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
- TLSH
  T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  AxInterop.ViewerX.dll
- Size 40KB
- SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
- MD5 edc5e696c4ad70f0be6301f703ab3672
- SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
- SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
- SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
- TLSH
  T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  CagService.exe
- Size 19KB
- SHA256 74c94094f7fe86c9969093456c4c167f129f9e1943c29c669b8e57cce3b3b07d
- MD5 05bc5532d193dd7d8c9809eefe5f6717
- SHA1 1fcee2c1c9ecf87cc62fc927db77b49b56eb289d
- SHA512 dc76b192c4e2465ae61396765feebbb3a3cb39c6a23a03e7ce6802a8097bdc27824d273d70cdd725cf797c7e06e9fafd9341fa1f422f4a916be0b7567d788cfb
- SSDEEP 384:r1EusU+04XxgXhJUOCklfyOyTJYy5qm2j5u:pEu302L2hVomL
- TLSH
  T1AF92E611A3E84B66F6F76F715A7206064E32FE9A9C70D34C26A4005E6A73B80CD7177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Common.dll
- Size 16KB
- SHA256 ab94b6aace3b74ed0fa4a70a199606e1bf8c312b81d1c075f1b3a40e47922cba
- MD5 997dc0eb0f031a6b5b0f5bbcfa45a056
- SHA1 47f9d69749316cdfb9c746390acf3219dd75229c
- SHA512 1106a0adaaff227cdfd27038de53098b2522d7696393e8a6cd722c308178900a676a5e4221899ead738802e64f7b3af40d0d36ee27359fe4b4f01cdc76ede43d
- SSDEEP 192:66HEVOfEEHwZI9SZM/ozVSg8eiCKiomqsEwwOgcsdsCLN0OHvPb7+e3gbM47MN2o:78RZI9AhN25kqsKORsdseHvPbi7m20p
- TLSH
  T11D721B398B38C33BC69A1A31F551DE6913B5974AB241CA9A8A14E85F3F033DA44059FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Core.XmlSerializers.dll
- Size 10.6MB
- SHA256 0df23b577e3cb2cf8b1fc356eb3a70faeb89e3974871855e2c2ff33953053371
- MD5 234829a34a9d264dacd52c5b0cbdb95a
- SHA1 95dc9fcaa40e01afaa084555b328fb3e0623af89
- SHA512 e0abf8ec1aa6694820158498b547381f35d53283d9b57c5bfdb913b3db12d5acbcc2205651dba02f2bf3d7634ed3f02ee5bf2fc3376499499a210a139ea53c1e
- SSDEEP 98304:88/TG3m4qfsloogYYDCs5akzP7YgZZu2U6F0FrT5hDXZe00NK:TT6m4Gslb/pP4bujzFv5h
- TLSH
  T1ABB630CC77E81E4BE4BF7F6215B15A119636FE2B4682E28F02E413B555B7704BC806A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Core.dll
- Size 2.3MB
- SHA256 87af304c8fb7c84b15f160331e1a4c803eeb6f4632499875a7d8f438353dcc63
- MD5 b0f179e4047b97f8de9744743e878486
- SHA1 e63dd8ad4591cce60b9bd44b3a6451ec567f2b62
- SHA512 032dc59f62945b4a6905c8336a057baf0ed4f90aa6bb987dd52f4c92b5a5e361c9d29b9ffca6662e32d93ab8e6100b38115c5d26e422a56a8f00d559c9b45677
- SSDEEP 24576:RB5iihsL26Ea3+X9aL8zi0nXR3X4D4u6/05pD68rkNuHE4o9M5qtyxGX+JaZX442:XkLisD5pD1IuM9
- TLSH
  T18EB5D91026B0DA9DCC690B34382502A6B3FFD64F4779D75E57A0161D4FAAB0B8B137A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  CsExec.Service.exe
- Size 17KB
- SHA256 b400644c9d4762d6d9649b8005338b2bef76b4f8704cff794b859c46ec1ee924
- MD5 5293cccc52665f2ce1a8bdb13374854f
- SHA1 fc5dc77a74728f9a9c8a931508d102ad92bfe3a7
- SHA512 6f63cb0367ca211866d90a2326ee9184e6293cdfbe6560f22777fd013c42f84e3aba7fe194782ef74822c0376c1d62e873d169392d4167641398fe83b711b904
- SSDEEP 384:bsZOOW1SXLqF9Am3p0vA3CNh0VcSWLreLO/lAKmd+esm2I:VSXLqGmavA3Csn0dmr
- TLSH
  T1EF824905AB90D7BEDDBA573D3CB347512B7DF7492212C39E2C8D481E2E9370806E26A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

DattoRMM remote administration tool

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32