Overview

overview

10

Static

static

5

DotNetZip.dll

windows10-2004-x64

1

DotNetZip.dll

windows11-ltsc_2024-x64

1

Entropy.dll

windows10-2004-x64

1

Entropy.dll

windows11-ltsc_2024-x64

1

HMC.exe

windows10-2004-x64

10

HMC.exe

windows11-ltsc_2024-x64

10

HandyControl.dll

windows10-2004-x64

1

HandyControl.dll

windows11-ltsc_2024-x64

1

IpMatcher.dll

windows10-2004-x64

1

IpMatcher.dll

windows11-ltsc_2024-x64

1

MailBee.NET.dll

windows10-2004-x64

1

MailBee.NET.dll

windows11-ltsc_2024-x64

1

Microsoft....es.dll

windows10-2004-x64

1

Microsoft....es.dll

windows11-ltsc_2024-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows11-ltsc_2024-x64

1

Presentati...ta.dll

windows10-2004-x64

3

Presentati...ta.dll

windows11-ltsc_2024-x64

3

Presentati...ml.dll

windows10-2004-x64

3

Presentati...ml.dll

windows11-ltsc_2024-x64

3

RegexMatcher.dll

windows10-2004-x64

1

RegexMatcher.dll

windows11-ltsc_2024-x64

1

SharpCompress.dll

windows10-2004-x64

1

SharpCompress.dll

windows11-ltsc_2024-x64

1

System.Buffers.dll

windows10-2004-x64

1

System.Buffers.dll

windows11-ltsc_2024-x64

1

System.Dat...te.dll

windows10-2004-x64

1

System.Dat...te.dll

windows11-ltsc_2024-x64

1

System.Memory.dll

windows10-2004-x64

1

System.Memory.dll

windows11-ltsc_2024-x64

1

System.Num...rs.dll

windows10-2004-x64

1

System.Num...rs.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    HMC 3.0.1.zip
  • Size 194.9MB
  • Sample260826-2kf95axdqf
  • SHA256 a258229de6a7d788402d70c9a003b6bc9a82044fb98f1b2f7742256b69944eeb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
svcstealercredential_accessdefense_evasiondiscoverydownloaderevasionexecutionexploitinstallerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Targets

    • Target
      DotNetZip.dll
    • Size 462KB
    • SHA256 46103e4d053be472f1c85223a43e179a5f022df14607febf6f48837473bd3e9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      Entropy.dll
    • Size 104KB
    • SHA256 68310ea51caca38b53b4ae3d5eb7a24127da4b1021c36963e77a0dacf4aeff73
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      HMC.exe
    • Size 13.7MB
    • SHA256 6df084de64ef7c4f6f676710a5f07a90fa1e2e9f1bef57d3e4b676d59e61e468
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoverydownloaderevasionexecutionexploitsvcstealerinstallerpersistenceprivilege_escalationransomwarespywarestealertrojan

    • Detects SvcStealer Payload

      SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    • Family: SvcStealer, Diamotrix

      SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

      stealerdownloadersvcstealer

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies security service

      defense_evasion

    • Turns off Windows Defender SpyNet reporting

      defense_evasion

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Drops file in Drivers directory

    • Modify Registry: Disable Windows Driver Blocklist

      Disable Windows Driver Blocklist via Registry.

      defense_evasion

    • Possible privilege escalation attempt

      exploit

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Boot or Logon Autostart Execution: LSASS Driver

      Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

      persistencecredential_access

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      defense_evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Modifies Security services

      Modifies the startup behavior of a security service.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      HandyControl.dll
    • Size 1.7MB
    • SHA256 471a6ce1aff5b635df599f21cf3e4894d9e893ec9d42d733f9f5c3672bdb8383
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      IpMatcher.dll
    • Size 12KB
    • SHA256 318d50f35b83ec3a2f0fc339d4155c47d2d9ddf3444047934bbcdccef8167e39
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      MailBee.NET.dll
    • Size 1.7MB
    • SHA256 7428e138a0b2a9e87f8c47076074d29e8d9ba18e07784db6d568ec15cde88bbe
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      Microsoft.Bcl.AsyncInterfaces.dll
    • Size 16KB
    • SHA256 fc3827cfb6834f0ffa6cb76278f309a3b598ae01c751f13fbeb57886e4168943
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      Newtonsoft.Json.dll
    • Size 679KB
    • SHA256 3be4fda7b6bd04e9aeaabf973ccc952afb5c0a6aa0fa672831ca82df218df84a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      PresentationFramework-SystemData.dll
    • Size 8KB
    • SHA256 48883bd04158c2456ea1be831b559b594fb86199c0d9618e7c3fde45a986ab26
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      PresentationFramework-SystemXml.dll
    • Size 8KB
    • SHA256 872673e0e79265978bddeb5b5c410417d553920bd373a9976a33fa1549f4b563
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      RegexMatcher.dll
    • Size 198KB
    • SHA256 9787a9a2cd79ba6fff3398e5cdc883c5ac1817c088d73fc7933f414b5d914830
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      SharpCompress.dll
    • Size 558KB
    • SHA256 f7cf666f0bf661f63ae3a5e531516fd68ac9353471faa78443f21bfd0a5f2f4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      System.Buffers.dll
    • Size 11KB
    • SHA256 d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      System.Data.SQLite.dll
    • Size 392KB
    • SHA256 7442d48a24c1747cb17d80e95c4d7343de16e14a252484ace3be3fae55b1d641
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      System.Memory.dll
    • Size 129KB
    • SHA256 d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      System.Numerics.Vectors.dll
    • Size 97KB
    • SHA256 1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

3
T1547

LSASS Driver

1
T1547.008

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

5
T1543

Windows Service

5
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

LSASS Driver

1
T1547.008

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

5
T1543

Windows Service

5
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Impair Defenses

7
T1562

Disable or Modify Tools

5
T1562.001

Modify Registry

11
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

OS Credential Dumping

1
T1003

LSASS Memory

1
T1003.001

Unsecured Credentials

2
T1552

Credentials In Files

1
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks

static1

Score
5/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

credential_accessdefense_evasiondiscoverydownloaderevasionexecutionexploitsvcstealerinstallerpersistenceprivilege_escalationransomwarespywarestealertrojan
Score
10/10

behavioral6

credential_accessdefense_evasiondiscoverydownloaderevasionexecutionexploitsvcstealerinstallerpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10