ca565f44d0c5daa432f3bde019768c5f5e0cff835934f6cc16e6bca5548007b5

Sharing

Copy URL Twitter E-mail

General

Target
Nomad Sculpt 2.9.22 [FileCR].zip
Size 204.4MB
Sample260906-vmk8jadp5v
SHA256 ca565f44d0c5daa432f3bde019768c5f5e0cff835934f6cc16e6bca5548007b5
MD5 e283a7788feb801de5d062c5e6e81492
SHA1 a7691710d4ab2e83044ce93cc2b2d9058c202501
SHA512 7768dba082c7f199a0e70c2db50b90475a73fb45836e5eb97fff0506683b6ffbe963fc70502501f3b701de697c3853221c5f464f9b2b31367b3387b9ff701970
SSDEEP 6291456:BSeRaaG9VOXK6lK27EEyoi3tklkO3M0FwYx8W:PR4q6i5jWt+kO7bKW
TLSH
T142A83337396932F9C9584C519AE4C258771BE3FB1662ECD08945DAC7FAD620CEFC0A42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Nomad Sculpt 2.9.22/Nomad-2.9.22.exe
- Size 185.0MB
- SHA256 10d879c78d6e4ad29e35c340c51aef2f76f545f39e051833c4ed67106884ccbd
- MD5 9a9f9099d61d18b995c1c1fb3bfed23c
- SHA1 6caddbd33ba3ae265a66e9bb65592b9d8de3d304
- SHA512 b5df8e5cdf6c42be6f434b6efb39de7560c855f6cc2fb9a2d3c204cf2d5e301eee5b42743fde65b6bbef2030c7b49ea80a0821660b43e09c3238a026170aa696
- SSDEEP 3145728:ZuEkWS3HmX+S2Hzo/Qq4PACGychfd0GwOnXh7q+pCbW4Eaa8o4sfSK+ty+p5TkQh:M7HTHzou4rfd0GweXh7B8S4EabXgSK+N
- TLSH
  T1309833DBEF64DF89EC7FD0385A34964458B7605539890B172C92AEB61CEBBDE21EC001
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Modifies file permissions
  discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Nomad.exe
- Size 56.9MB
- SHA256 5541a7c18429f52f9b7524f8c0e210bc879bd122b11176610281b1184a0cbb9e
- MD5 697875304115ae468bb126fcfcf5e301
- SHA1 345d839a94a8c6c6dc2520c57c4954a6fbcf7005
- SHA512 4e67c6efdb803e85aedd916b86cb832569c821688d9009a72f87902ac721a75c4f4e44d86feb9a6a38b5fbbea1168d69869335f01b5519232743b28435d1a86a
- SSDEEP 786432:I8zvDhayZHKTcEhtAl1k+Jd1IzGgNUJhAvsQhCu:I8EcKtEoDCu
- TLSH
  T1D9D77C8BE296A0DDC52EC17243573632FB31784647356DEB16908B302E76BE02B7EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral10 behavioral9
- Target
  NomadThumbnail.dll
- Size 571KB
- SHA256 2d026a16a2202150a220d5a9d67eaf1a1efcf63a5e6b7ffbbef93fb9af6dda33
- MD5 d3608578cb46c1b21c392326559da0f9
- SHA1 3fea19a953c7e8f15d6880ab26af9aeecf64add6
- SHA512 476d9cdbc52623288a800fe120c2d26ae570edc4870354a4870011593a58cc7c01fbf4cf3127b3e2d39686e699a28cf21817e72ab4750bd24f941e7d1df7eb1d
- SSDEEP 6144:L9d3HOcgD8EAratUd4nvHmU1vjLG4DYPZgCJ89ar6/+6NstaJTGyTxiH3ixR9SUN:L9de3nvGgzf7J0IB6z/uSS8uU
- TLSH
  T131C4080673A88A6BDC12A63C95CF631E6375FCA0179396DB932012215E47BE8CD7FB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  OpenImageDenoise.dll
- Size 185KB
- SHA256 26d81b0dc6062a0620e4a80eb31f5def6a69e873746f39bfd15179691c5b4616
- MD5 951d47948080d49e871aeffaa59c0934
- SHA1 77167b1cbb6f764335f1d16d6179e4da518ee570
- SHA512 3250b7d5e827e8e7bfb842f5108fde226c068b7f8b64b0eda0258357a2d531a13465330832637024750cda9badaf14eef6c6eedcf52999228f18949ebe6fee81
- SSDEEP 3072:0lHUeEh9OK6Ve1wr312kqfz11gG5J+zvgkgohI7uvKiprAPgVB:reEhsK6Ve1wr312kqf/t+zvngosuiilb
- TLSH
  T19004B5263B5AE729C40BC0F4C2C345792E7572CD4F35ABAB4E8797382E61BF46E69014
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  OpenImageDenoise_core.dll
- Size 48.3MB
- SHA256 830bffd8b1bc071468d27b865e8c07621e9c75ebc9d281e5f5e0525ff0bc027c
- MD5 d80e771e8a760c54b585cb338d9a5ad9
- SHA1 f022a60a12a9d85a9c71d42a7cb32f841d3fbbdb
- SHA512 e89a9c16c957a45bec505d06cc2182f05fc692767574004f5df784a46a4bf82d417e85407472a6dd53594b0c409da986c2c2c17e7de0bcf9e23defa740c4edc3
- SSDEEP 786432:8Kak7kyL9hJp3m2+85IyOmQbVHrIMJOzetlecilh:HV9h22+YOmAx9YCt4RP
- TLSH
  T12FB733B372E13DAFC146C97D8751E83059A7DC7B8B47E186748582ABEC2EA24CF15B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  OpenImageDenoise_device_cpu.dll
- Size 647KB
- SHA256 8e11df59627153481195b7b1bdb4ede5c6d32c17088f2be9d045f2be389b57a5
- MD5 73338620afb28225bd736fceda1c8079
- SHA1 30d88fddc26414b2af53d1b1ce71d4bfe52ca5e5
- SHA512 d76b5355abef9b807e095ac1fd10fde8221d1dc0a0ae297b274ae72dfcb9dd70f668140f0616e698308520cdb4155c9e82a64b4ee6a4689c453cc1c855066dfc
- SSDEEP 12288:YYkw8ixKaLVCt6MLGfZy4ao4py4uo4pmseS2PVE:YYkwhUtaBy4ao4py4uo4sXPVE
- TLSH
  T1A1E47E1AE17E62A7C516E4B281176B3CBE61748E0B091AF360CAC025AD937F43F75F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  OpenImageDenoise_device_sycl.dll
- Size 738KB
- SHA256 391d49070d0931a8f4f3a296a6a9ba2ceaeee39467e9fcf4cab205766396d152
- MD5 27f0ee0744e3755e0366d5a2fc397260
- SHA1 998fba259eb83d6cb858970c2d9aae60387e6011
- SHA512 1d71562c61853f513999224c986dff4011bd053acd6b8fcd9b44bfaff0004e87db75b39adf7143dc59ed47f851d4ea2f56895734be48f3105fb8fc1d5ecf5ac7
- SSDEEP 6144:dDhjDvTRn5cQPw3RtRh4nMS8V2cDTH8LdK6UtMTJ/RJIADDalj7LJhOWPhSBO7DW:dl7Acna4ktMNogGhB5OVt
- TLSH
  T1EDF4D522F685CF53C8AB8B3581F708647635F4999B13EB9F0190B2393DE73B5AD26124
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt5Core.dll
- Size 5.9MB
- SHA256 97e813ae8abe3005ed752e07698173e560985625aa6ad07fbcf873aadc1b45ec
- MD5 2237d9bc4b2cc0247910ea2b80cd0a97
- SHA1 feb26603f1f91708385eea80a9c1651440b798b7
- SHA512 6daae2ad9c8beb18a55db40ad0e998ab92e6f1c1e2048b5de8d18e7671d7a66e631515673b9c2639fd37eaafc64b13583428da1424ffa71dba1e07bd11ca6da2
- SSDEEP 98304:oSZaOoW//wRaJsv6tWKFdu9CUVn74FDrqft:oQabi/w8Jsv6tWKFdu9CUh7aDrqft
- TLSH
  T182567C5777A64161C0B6C23CC9EB9296F672B8154B328ADF1259A20E5F337F0293F316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  assets/shaders/utils/shading_pbr.glsl
- Size 8KB
- SHA256 eac6ce67861353be8384fa8d6e866561213671200521628131d5d522bd647890
- MD5 8268b010d2ae4db1eedfcf26bbe14237
- SHA1 385ef93a4bbd3608c5772153d5b1f90b304a611a
- SHA512 e838364882a5b8682a03e357704174e6578d9fc1bda1ed1ff248b40493d5dd987033014fb0e7be6bf713dec1be0fa4738c864de15a5ab3fe7f477f5dbbc19f90
- SSDEEP 96:UioVUcR7/6Aau2DReCWqzfw7YOJu7dbY/Thbl3oYlQo7ZJAZtFV13qn1f:ZcR7l1Oe1Aw7YOJu7dE/NR4lO1f
- TLSH
  T170028337A91310606D67E07A6F8E50CA467AA19B9A48C1513D2E91A67FF10FC13E37CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  libfbxsdk.dll
- Size 7.6MB
- SHA256 f6cb138c11da38f7f9538059c26f5a0ccee226603e6bf73313a9d5089f21aca1
- MD5 b2bcfc79fd61a384902dcfaef884909f
- SHA1 ce6628bfccff5a2ba678f89bbbb31a27114e8ce6
- SHA512 c2a455f36a07002f39923e565fcb2abf38b715ccb717a757be047adffb9f20b9c337b1f2446d428b1ef745bb88191a12eab931ad7927c59dd3d8e2256fdac8a7
- SSDEEP 98304:TzG/XoLg1dO1n7KgG2NdayrfIwFke0yJrs:KIg1Mn7KT2qMJ4
- TLSH
  T18B865C5B62AE02E9E1BFD17CCA870907D6B23001533A9EDB02964A5E1F1BBD59D3F710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  msvcp140.dll
- Size 544KB
- SHA256 1e2e2bcb916931f0ee6d0a567212511244e7442da574757c331c1b91087f2a0f
- MD5 b08063e2d0bb587538575af2babac0b2
- SHA1 82a72fad0b6935880fa9909db183b54d09285b39
- SHA512 f1345e0ed02c5f4208766458b68792995b37a103e8951286d9b97dcb02d52d1905f63a395a03459643518e5b51817744548bfbce8d5835fdc1c4e828e29acde7
- SSDEEP 12288:ihSlSEiVO3dam7VDIsZEXES1gfQEKZm+jWodEEV4Ks:ihWiVO3dNIsZTS4QEKZm+jWodEEOf
- TLSH
  T152C41A27F74906F0E195E3B8A1838702D7F1BC4A8322A3C792EB955D2F573D0A67B650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  platforms/qwindows.dll
- Size 1.4MB
- SHA256 413f65f3dc3639564b927c357a733024a8f94a7847c0707694307cc5c3fc2f25
- MD5 d00e8dba57dde95eac770c2c4e1e0ddc
- SHA1 370e15e178052cac31f1a9a904e7b3aaedf367a4
- SHA512 d1ec3bd2eab6597012572cda6b61400bb74911a3c6ad6977ccff04e2ea8dce1f0ff11012bdc85dc53b60edf321355923fd99489a51eb5deb9d3b57e4f1b5a8ac
- SSDEEP 24576:SPkYB5vhONxspBhlWG3+tWw+bmH70X8mp1ShZu:QkMhON6p0GOtEmH70Z1SS
- TLSH
  T1D0658D57A3654294C2ABC23DC64B8B07E6B1700503719BDF01A88E5A7F23BE3277E756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  steam_api64.dll
- Size 309KB
- SHA256 eb17909a76668cf9ae0b92a618a34a50f6c73d3a6787cb4dd8ce36a8b10bfb75
- MD5 6a93fe4dd0a832eee52b20e711063ef3
- SHA1 45805c752f2d438889e476cd3773789847a8c82e
- SHA512 e6ca4b966269ff85829ce119673a5b143d6f417aaa806ee56d6697cfc768840dfc267e2a823114d6c6f5aa1fb42c86f33ab7befbdf4fdca2984b7e0cff71f7fd
- SSDEEP 3072:n0leVP204SLiYl7rOa/3KJBTrpH7u+h6yrFDK4uvLE+m5lhTbCgMWmXCEIyq+nUv:yeJ1NiYf/6JBTrpfUyBGh9F4ynv2ClSr
- TLSH
  T149646B3962750CF4E077C13A88465E0BFA75344B23219EFF266062369E177C21EBB7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies file permissions

Drops desktop.ini file(s)

Network Service Discovery

Drops desktop.ini file(s)

Network Service Discovery

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32