a52ffddf46be83d75088c476d333e4fa19e70b360ae8dfa89bfb619bc649afda

Sharing

Copy URL Twitter E-mail

General

Target
HeatSaveManager-v1.0.12-windows-x64-installer.exe
Size 6.2MB
Sample260907-khk2vssfng
SHA256 a52ffddf46be83d75088c476d333e4fa19e70b360ae8dfa89bfb619bc649afda
MD5 8f7968856f50a215b7667c0b7c6909bc
SHA1 bedcdb94b6aca69e6a57e4a1497b90db32279a89
SHA512 0c6cd2888a08e4f7a23fa211fe9540f1e645027e0c51975596e1f0b11ae8fde56fc9f2ea40f5da6ee885d945c69ec85967c5c95d0600009bfd394b8590a3c872
SSDEEP 98304:vP7UdoocaFQVCzSpasCGSKwZh3oQRAAQ73WjMgk8bpAYARYMRhPgTdNfOoYhTFGP:vP70yAyMGkhNAAQ7pgk8bpJAtgz4l0Aq
TLSH
T1006633A6C0E41A0AD9A0F478B97FC99C09B8C4112E393B1980467B7936FF94DF5A3F54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HeatSaveManager-v1.0.12-windows-x64-installer.exe
- Size 6.2MB
- SHA256 a52ffddf46be83d75088c476d333e4fa19e70b360ae8dfa89bfb619bc649afda
- MD5 8f7968856f50a215b7667c0b7c6909bc
- SHA1 bedcdb94b6aca69e6a57e4a1497b90db32279a89
- SHA512 0c6cd2888a08e4f7a23fa211fe9540f1e645027e0c51975596e1f0b11ae8fde56fc9f2ea40f5da6ee885d945c69ec85967c5c95d0600009bfd394b8590a3c872
- SSDEEP 98304:vP7UdoocaFQVCzSpasCGSKwZh3oQRAAQ73WjMgk8bpAYARYMRhPgTdNfOoYhTFGP:vP70yAyMGkhNAAQ7pgk8bpJAtgz4l0Aq
- TLSH
  T1006633A6C0E41A0AD9A0F478B97FC99C09B8C4112E393B1980467B7936FF94DF5A3F54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
- MD5 d1eefb07abc2577dfb92eb2e95a975e4
- SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
- SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
- SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
- MD5 60366cbf515774ffde2b49297c3d2e9b
- SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
- SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
- SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
- TLSH
  T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  Heat Save Manager.exe
- Size 10.8MB
- SHA256 cae784404ad1b8c612bf885e3d8c86c6383071f1fc01f1f68c0949ac290db342
- MD5 7a355564f4bc31236b9574a6f824c6c0
- SHA1 64be49efbe27c0a70b331576c3d08f89b44e96bf
- SHA512 3de0ad42c7cdc5765370bfcf47414ef27ae5d9c780753e6f86352360f5bce3fcbdaa7e0b711b00f3291792f939c044f8ea309b5659ae314b4d1d8e854dc97889
- SSDEEP 98304:gRh3wzodFH16s+d+6/pQDgOCSrFrRYkfJ/BYAiN5OAHE5xA:gRZwz+2s+r/pQPfFr6k3wOrT
- TLSH
  T161B64B07ECA544E9C0AAD675867292537B71BC885B3127C72B60F7242FB7BE05EB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral15 behavioral16