General
- Target loader.exe
- Size 67.1MB
- Sample260905-s2c5csen3w
- SHA256 2aa3bca54d0fd524714a153f1b4d246ef6b12c4b22112f275e89c608bf5f7507
Malware Config
Targets
-
- Target loader.exe
- Size 67.1MB
- SHA256 2aa3bca54d0fd524714a153f1b4d246ef6b12c4b22112f275e89c608bf5f7507
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Mark of the Web detected: This indicates that the page was originally saved or cloned.
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/bundle.jsc
- Size 1.0MB
- SHA256 4ed1f55274af377e491ab6be8091e2188cb7a18f5cf17b9603c23cc879554f74
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/loader.js
- Size 183B
- SHA256 195136147a5049f4af25bc27f80e92a531373bc7ca667325f407f3fa79a13433
Score3/10 -
- Target resources/app/node_modules/@koromix/koffi-win32-x64/index.js
- Size 52B
- SHA256 f9991ec70a0f775487ffadc2461d69edd1555e3d9bf80de0bbdd2eec7d245c49
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/node_modules/@koromix/koffi-win32-x64/win32_x64/koffi.node
- Size 824KB
- SHA256 96d76a15753e6588abd7a4494985230b795ef8490eb0ebaeb255836bacf2b211
Score1/10 -
- Target resources/app/node_modules/adm-zip/adm-zip.js
- Size 37KB
- SHA256 ddc2c82e58df0054ab2f55153c09435ede4ff593b29747e850d3d22fb6eaba97
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/node_modules/adm-zip/headers/entryHeader.js
- Size 12KB
- SHA256 6ed1ec82e6124d71dbfb4ee6e5dd4c975657854354cf74741427a1862010a664
Score3/10 -
- Target resources/app/node_modules/adm-zip/headers/index.js
- Size 94B
- SHA256 536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/node_modules/adm-zip/headers/mainHeader.js
- Size 6KB
- SHA256 ed5a2b3fc7c8a6937e07447eb3e55e08a0655d2f24fe04039e7008845d221a25
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/node_modules/adm-zip/methods/deflater.js
- Size 1021B
- SHA256 6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
Score3/10 -
- Target resources/app/node_modules/adm-zip/methods/index.js
- Size 128B
- SHA256 d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
Score3/10 -
- Target resources/app/node_modules/adm-zip/methods/inflater.js
- Size 1KB
- SHA256 7b62c190669eeefd6b2810a3339d9109ecb219f845fcd12ae93518beec35dc49
Score3/10 -
- Target resources/app/node_modules/adm-zip/util/constants.js
- Size 6KB
- SHA256 208e943a2e5faad056047f3c7991cce3cde637d8e272a564f2546210ebdf2069
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app/node_modules/adm-zip/util/decoder.js
- Size 130B
- SHA256 73a0ebb00c4dce2124f07acf0b34374cb03a4384cccd1cd6f58aee27c35953d9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Accessibility Features
1