1a9f9ab99575270ef658028f7fa8e7bf2615e01664c15078bd1fcf81ad2a2800

Sharing

Copy URL Twitter E-mail

General

Target
ok.7z
Size 7.0MB
Sample260827-nemytstdrh
SHA256 1a9f9ab99575270ef658028f7fa8e7bf2615e01664c15078bd1fcf81ad2a2800
MD5 cc56fe4e75ca7163d8621336469d60e8
SHA1 b9167fb3c73343be1b5dddf4dbf315261126db1f
SHA512 fc9e7520444207b5444e9d6332fe385862454d9e93061ed7c75779a814a96717550373245f0d6a79974932ec3dd21e215fea2c59a730c898a779ab524b79cd7a
SSDEEP 196608:ubDnainE4D6Lf0O+oUr+V0XmdqOk1JSTkAmWwu:u3naQ3D4f0O+oUr+VWZJWNmNu
TLSH
T1B576336C35E82BB8C18BDE7DC4965E5704BCD48D828BA41C53E7CE1DBABF65803930A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  DSE-Patcher.exe
- Size 1.9MB
- SHA256 a1a2730bbaa95082c28051becf2eacc2e2f1f2951b7d932a96c8744712049acb
- MD5 2527dff88ad0570267e33c3742142edb
- SHA1 46267beb976f097db4129cc624745cbef94cda84
- SHA512 bb2f1a28b16f11c212223607005cba0e350bbc6901f7bbdb30edb186687a1c6982ce2f80886d400b6359a66b22d0482245bb18402eb214db8854a6abf2c10888
- SSDEEP 49152:KfPVpFCsfZRZA6Xn388avVovfLd+Mo4iEdy:KxZ2ans8GVoLd+GnU
- TLSH
  T17C9512816BFC05A4F1B3DAB087B9C417AA7978811F71D28F11A1D5691EB3FC09A3C31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral1 behavioral2
- Target
  bin/RobloxCrashHandler.exe
- Size 16.0MB
- SHA256 278512466f7c6734cb85abd1c238210285e1a122119a8ddf1b8e9ce6975360e3
- MD5 f03d5f49c924d4ff17f9044bbde8c480
- SHA1 59c907c75f9f899ed1edfa77aa0a53df5fe4caf2
- SHA512 0de71519707414c31734c38b720304dafcf9ec10859c3a5900bbeb7875a4df538c6f2c3607cf6651309d8675ec26ce4bfa3bad0ad73c5cdbcc985b86e44d9797
- SSDEEP 393216:lK+2ty3iyLfp/bqVsaANRu9ty14gO3geoY8E:lKUbqVsTRcgdYr
- TLSH
  T133F63BBFB6728E99C0CAC57255C69BF11B30BD2408B5134723D5331E9FB68805E9AD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  bin/ddaa.img
- Size 498KB
- SHA256 a1cd2c67e2376abea5db2b929405b77238d8bf9970dd564d7bdc2ce62b4a937c
- MD5 55e5f11e568df82c41a4fd6449f9bf23
- SHA1 1ec35a8a90d40f724b24ec593d18e72fdd6a3689
- SHA512 59a6d3eb9774686282e21aa488a70a8267fdfc2d027d8091727c12c2bfd837c73c231811a006f0db0e8b44a6c3b5647d4e1984d959c5c27e140f7c31fbef791e
- SSDEEP 12288:vLD2YksHQMuVH4N4TTyHUi6Gn3yNx0rt/r0UiH+mIA:vLD2OnNUi6Gn3yNx0rt/r0UiH+m
- TLSH
  T14FB4093EDB73C2A8E117E278179F8691E67074F8173478CF53A20A721B62A544F6D3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  bin/libipt-32.dll
- Size 157KB
- SHA256 d14911c838620251f7f64c190b04bb8f4e762318cc763d993c9179376228d8ca
- MD5 df443813546abcef7f33dd9fc0c6070a
- SHA1 635d2d453d48382824e44dd1e59d5c54d735ee2c
- SHA512 9f9bea9112d9db9bcecfc8e4800b7e8032efb240cbbddaf26c133b4ce12d27b47dc4e90bc339c561714bc972f6e809b2ec9c9e1facc6c223fbac66b089a14c25
- SSDEEP 1536:K3uc99F6AOdjfTOZztxlGWGXLQbcpNk6FowD6QcEY7Xjl5hf8keDQa/c7usWjcd6:K3ukXTNGp7+6zaEY7Zf/a0ye3ZoOvKOS
- TLSH
  T118F38D12FAD1C131EA9A067991FC9A138F7D7951CFB888D7B794055CC8203D26F3AB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bin/libipt-64.dll
- Size 182KB
- SHA256 26ede848dba071eb76c0c0ef8e9d8ad1c53dfab47ca9137abc9d683032f06ebb
- MD5 4a3b7c52ef32d936e3167efc1e920ae6
- SHA1 d5d8daa7a272547419132ddb6e666f7559dbac04
- SHA512 36d7f8a0a749de049a830cc8c8f0d3962d8dce57b445f5f3c771a86dd11aaa10da5f36f95e55d3dc90900e4dbddd0dcc21052c53aa11f939db691362c42e5312
- SSDEEP 3072:XMTS4QqrM7BqUHEwXDVT6B8AF6aBBcFkLODeYJObCkEjOUkOG:XIQqrc7V5Trw6aBBcFk6CtbID4
- TLSH
  T1BE046B8BF2A400BAEA53DA38C8D74506EB727452C7A49BCF4254027ADF573D25E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/libmikmod32.dll
- Size 300KB
- SHA256 aedc048fcfec594e7307e4730d850e5e0121820a76ca1a363f4a2e41d084f393
- MD5 462322cc93e55016d5ea78b2b9823657
- SHA1 3e8e00b690a4370d6f2dfdcf730f2d3fda4806a6
- SHA512 a46e56130a8d1ca588d9935d98468543328b42492f1257157d2c7fd99ac341e8a22337ac2228aecf33a70913a7e7161b300bb458e1c07d5d0b94a7aa1dd72d79
- SSDEEP 3072:3QMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+XkO4qOT:3NJyTuxkC57IZEzGmT
- TLSH
  T1E3648DC2B6C15276E28EC4BD92F94766387D2A30539496D7DB8163A8C720AC0773DF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  bin/libmikmod64.dll
- Size 331KB
- SHA256 25c648cfdb4cdbbb13630adc7c14f2bb556c98f5cd1dcbecaffa91629d2d4a4c
- MD5 a358dae60f1c0f6a633f98b1e4d3e850
- SHA1 2016f1fb0f8000e515602498432951b7c5bc5aca
- SHA512 879b5e95cf7f06e105930724bbc6967b367417dce390a15de48bf5ce76ce2435ea4a59095ab67eee5a05fa41126ddb984c2154aba34b33fac895a1ccc2d2a617
- SSDEEP 6144:ZnVdQfxRaiC76I/wZGteu+WJrXeN6joNtMrvMl9u61s1JGTBHpMqdmgIIE5pY2B:jdsxs6I6k9MUoNt2vSs8KqdmgIIE/b
- TLSH
  T1C1747D4A73651892FA27C57C88A38249E2F53DA70BA19FDF526089792F63FD2173C710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bin/lua53-32.dll
- Size 453KB
- SHA256 435cb67e970ff69626f4adc7e9e2edad24ce6ef62ad266eb56058f7223a2399d
- MD5 2916c008cfcc67b2aa73856cbd4adc73
- SHA1 85f706e61cedae32d4d97b235203d583a214d6f0
- SHA512 99a22c1cccbc92e34c87c2952ade483587e9309cb210910f72f0e4bcde886a8a6490e98bef7d50652be06b1abc3ff9f027967a7d906e412679ea080b0844d30b
- SSDEEP 12288:7dzvaT9mMCm9N19Ze0lV8FihEVwQQCyMOVhpzby:7gf9N1Xj8aEICyLFzby
- TLSH
  T158A4AF127E52C031D5B8047559B9A772CD38AD200B3CE4F7A7DA48350E742E2BE7AB67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  bin/lua53-64.dll
- Size 503KB
- SHA256 56de95540c133b31acca4df1149a2adc8ce12f28357da33ce67896d9fc71f88c
- MD5 864949d7ae81f7f17caf1070d0402398
- SHA1 8680219d6a0c5e4640af68353789779707901f33
- SHA512 773bf79dabda6334a8bfe737b319ea9cd31c2a6b27ffb94b079ef467cf7e6da849759aff79221e6872748990067cea943facc42e893543f1a301dfd42328b178
- SSDEEP 6144:PshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5h:XOL9J2L8E5VKKSuLGEhXGstCXoYkc7B
- TLSH
  T15BB46CA8A6781ABDEC7BD13AC9830917F7B234150B62DADF02E066751F137E2167B710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/luaclient-i386.dll
- Size 197KB
- SHA256 dd07117ed80546f23d37f8023e992de560a1f55a76d1eb6dfd9d55baa5e3dad6
- MD5 9f50134c8be9af59f371f607a6daa0b6
- SHA1 6584b98172cbc4916a7e5ca8d5788493f85f24a7
- SHA512 5ccafa2b0e2d20034168ee9a79e8efff64f12f5247f6772815ef4cb9ee56f245a06b088247222c5a3789ae2dcefadbc2c15df4ff5196028857f92b9992b094e0
- SSDEEP 3072:fr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZnwO4oO8:fg3mrHb2+z615yQ7GnyOpFOEFKD2G
- TLSH
  T1F6145B57B5019277C7472EB8464A4A956A74E62038F2E0E77ECB0E4F9A74FA06F34307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  bin/luaclient-x86_64.dll
- Size 260KB
- SHA256 253d18d0d835f482e6abbaf716855580eb8fe789292c937301e4d60ead29531d
- MD5 dd71848b5bbd150e22e84238cf985af0
- SHA1 35c7aa128d47710cfdb15bb6809a20dbd0f916d8
- SHA512 0cbf35c9d7b09fb57d8a9079eab726a3891393f12aee8b43e01d1d979509e755b74c0fb677f8f2dfab6b2e34a141f65d0cfbfe57bda0bf7482841ad31ace7790
- SSDEEP 3072:KK2iOI60nWU4NJ4twEywGLOJQbcOL9z32fY8iV1OQfkz5w4Q7hk1D2oOyPOP:KKu0WU4J0w6xJkBAY8i7fkaThkA4g
- TLSH
  T1D3441B6B7612CEBDC0CFCB75448A86E2D230FE500DF5974622C12B1B9E76A906FAC54D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/sleepdriver64.sys
- Size 91KB
- SHA256 6a54e10f4a9ca047fd7dc657c0e65fa5f958cc68c9b17b03842cb4d0ada7a553
- MD5 a1e4d281e68a26e5a67dc78446159e02
- SHA1 855032c9e49826c99e43e10278bca1dd8ce17dfd
- SHA512 c0f5721b694d34810707e94a0b6bbf0e532caba60e58e2e32feb042885a8763dd39f3df06aaa27bbfda72108bac89bd901c0b7dda5bdd683bc72ba087aab8790
- SSDEEP 1536:DJsLYVUbN7TdDdqO/AWkFY9OVs2AS1Z7slqXEEqCdSdR:YdDYOoWkK52ASTsc0EAdR
- TLSH
  T18A93C905F7A250E4D876D17D8BA2362AB9B0382847357BEF87509A620B71FE4DE3D344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  bin/vmdisk.img
- Size 494KB
- SHA256 864e2785c18cba321d8b1e2cb0dc5d3c4882017128030ef42ea5c709ff2daf73
- MD5 78ecbe1be918f333117e2fa99d1218f7
- SHA1 a4f756bc62fde85c23ba14d8636ece52056ec7eb
- SHA512 91fcc7a6dcd46d2e458c8c420193801624befe0d8c1ad9a0e6a35c73899145bfa4e3c0861526e6d7f3540574ab052d5d23953033e1a2a222a1656b997bd0e5de
- SSDEEP 12288:vygidMYnlzFAs5gPVeUUi63t3yox0at/m0UiI6my8:vUNT5OeUUi63t3yox0at/m0UiI6m
- TLSH
  T165B4F93EDB73C2A8E017E27C179F8691E6B074F8173478CF52A10A762B62A544F6D391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral24 behavioral25
- Target
  udProcessLauncher.exe
- Size 22KB
- SHA256 29a747da953428f8bad2293a760058914d3ad102bd3c1fa3c5a77fbb76d369ca
- MD5 4bbfc18103ec23f1ca9c6c24ac8c9153
- SHA1 301aa70d67f94dcf3dc42f84d318ab9b3c16f99f
- SHA512 28ea650aa2210cbe7f325d80ace92a7973076f177805a703332fdba4eba74ccee3e9311e4c6e3e11b5a7557d3eb991e021ac4e9c63b219467326198995b97da0
- SSDEEP 384:KfSto2HwfNl4LN4XZ0YZRRKY7f66fQb0bVR8yy0oqSYToyQ+LN:UDUB3897Qb0bVCyDnoyTLN
- TLSH
  T12EA21B07B79B0DEAD0A692788957051AD3F27D065B31E7CF5381105E0FBA2E0BD7AB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral26 behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27