22780f3d6ef5a5e33a7578c6d8f969e5deacd005658d288035c8239c7ec696ff

Sharing

Copy URL Twitter E-mail

General

Target
StarUML-Setup-6.3.3.exe
Size 134.8MB
Sample260906-xp13wafj91
SHA256 22780f3d6ef5a5e33a7578c6d8f969e5deacd005658d288035c8239c7ec696ff
MD5 602581a74d11977b341291b862d96cad
SHA1 5fe4b2e4e103af0a63d9f0b1fc5d5ae1bb8e1061
SHA512 f03627dc69966130a7b827aacc2067635fddb678034f6f7bd1a2549fe9ee13460c3dd8378a2b55c5abe905b86b19e039ac183f7a9540bb958a694572a1586c68
SSDEEP 3145728:3dZXRK+iy7zJpO/Kg+tyGRkkPczXWfMgXKKA1iuBjLtv+d00q:rX4+iyZpI5ayGR7czEMsA1igLtGdRq
TLSH
T126683387DB90C7A6FD23B473D56B9060AE4900E16D57E5B0CC2CEF2628DFDC01A1A96D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  StarUML-Setup-6.3.3.exe
- Size 134.8MB
- SHA256 22780f3d6ef5a5e33a7578c6d8f969e5deacd005658d288035c8239c7ec696ff
- MD5 602581a74d11977b341291b862d96cad
- SHA1 5fe4b2e4e103af0a63d9f0b1fc5d5ae1bb8e1061
- SHA512 f03627dc69966130a7b827aacc2067635fddb678034f6f7bd1a2549fe9ee13460c3dd8378a2b55c5abe905b86b19e039ac183f7a9540bb958a694572a1586c68
- SSDEEP 3145728:3dZXRK+iy7zJpO/Kg+tyGRkkPczXWfMgXKKA1iuBjLtv+d00q:rX4+iyZpI5ayGR7czEMsA1igLtGdRq
- TLSH
  T126683387DB90C7A6FD23B473D56B9060AE4900E16D57E5B0CC2CEF2628DFDC01A1A96D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  StarUML.exe
- Size 168.4MB
- SHA256 8fc98686b3a6fe3af4a65890dee90723a6ee05b759873973d1e842c4eb0491ac
- MD5 fd7f42da249e0c6dc62af7049bc081c3
- SHA1 584a75061cf1d929b7c4cc089e334f4870793c5d
- SHA512 4fafc555413e64d863d93ccb6f5a48d92d4a68b1fddb7968a08b0bd5b3f866003e266620dedcd958e3183315aed696cc1f985e5eba5fa528d66208ff05acce50
- SSDEEP 1572864:igRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hm:Wg/geeFXzGa9FzG
- TLSH
  T171887B03E2DA50D9F05DD1B18B979633EA72B8464728B6DF265407162F77EE02B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH
  T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH
  T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH
  T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/elevate.exe
- Size 115KB
- SHA256 d8e57097f4be8dbe6056664d590ce10919af35e7c5d4da1e3d4bbfd02ac16c9d
- MD5 7bd33a30b011fa1873e013ec1d700d9b
- SHA1 abc0d9e508ee998c974ed87ae5370e083dfb2f4f
- SHA512 57dd8f25d060110d4ffd4545b98e6f2fd20fa7bb7f7a5c8708643da62f563417689a56e01132454e6ea5ce5f1c60ae773371b05018d55ccbc9dc62e37f366bcd
- SSDEEP 3072:FNbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlRE:vPrwRhte1XsE1lO
- TLSH
  T1BAB37C1274C08471E5732A3559B4CA714EADFD710E759FEB6398027A4F602C0AA3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
- MD5 8fe00ebe76542263463877f27417ec61
- SHA1 763502e57a3c4fbe5fc25ee7e9c942d94505d244
- SHA512 62b375b40eedf04d03d8465570634b56d529e9525bd6d81be94b40c7da21cccaa808be97649f9404ded9edd5ce129f9fb1d462c6a1986a25fa8a228857cda5a2
- SSDEEP 49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
- TLSH
  T1E9363803B2858199F05ED179475BA632F232F8801B76B6DF52A41F192E77FE02B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
- MD5 d8f31216785e204da9bad10e9f3734b7
- SHA1 be7f53566dbaec5dbe61afc76bf7401cfc42ef08
- SHA512 d7ef5ef7ed9b5559e107369849adcd18fb9c9c3a90033731a46c4b5d3ba431582936e54e5b5918ce19a667b3f1eb369a93bc3f9a03df8e5397e5f80dc21a61a1
- SSDEEP 24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
- TLSH
  T115154C23AA944669D476D034C8C28607CAB178912726B9CF03A81718BF6FFF4777DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23