b376ba2fe63987ff26b2d773b7e3ffb19c06f69c62935585b31edea69f3ade08

Sharing

Copy URL Twitter E-mail

General

Target
processlassosetup64.exe
Size 2.8MB
Sample260908-3x2l9shr3s
SHA256 b376ba2fe63987ff26b2d773b7e3ffb19c06f69c62935585b31edea69f3ade08
MD5 baaab6524338fc78ce72f96a53c5d2a9
SHA1 f7239ef7c649df3af6b3e1ceb80243913c571189
SHA512 e1f3f038026128639aa781542bc1dd8025b5bdef12aa144a732aae9cb6ac22789d1314ce7284f0b39bf0a863ecaac193d5556b5fe79c9e2144219c22b3171cb6
SSDEEP 49152:z6buEMVEN0XM5t9iQ4LqFWxNOg/EQPQzddk8aycPVgLt:zshQ8XOdxEg/DIJdk8xc9gLt
TLSH
T1F5D5F0D10ABACDACD451DE7C8A90CCDA64CF9E1C923D36369678301C5FBCBDA6894C25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  processlassosetup64.exe
- Size 2.8MB
- SHA256 b376ba2fe63987ff26b2d773b7e3ffb19c06f69c62935585b31edea69f3ade08
- MD5 baaab6524338fc78ce72f96a53c5d2a9
- SHA1 f7239ef7c649df3af6b3e1ceb80243913c571189
- SHA512 e1f3f038026128639aa781542bc1dd8025b5bdef12aa144a732aae9cb6ac22789d1314ce7284f0b39bf0a863ecaac193d5556b5fe79c9e2144219c22b3171cb6
- SSDEEP 49152:z6buEMVEN0XM5t9iQ4LqFWxNOg/EQPQzddk8aycPVgLt:zshQ8XOdxEg/DIJdk8xc9gLt
- TLSH
  T1F5D5F0D10ABACDACD451DE7C8A90CCDA64CF9E1C923D36369678301C5FBCBDA6894C25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  CPUEater.exe
- Size 570KB
- SHA256 1eb7a9260e7292f46afc477a49844564f642479ffaac0fcfbe85d17186aec878
- MD5 b39198fb758c54ed849def4cf3ed93bf
- SHA1 790c6e1a16cbea15e2b2c464d7ff085082ac8a0c
- SHA512 c23996c8f5662b8dc73c8080f466ed8ba0df2fb0cb214474926f6e70dcfcec70a7ebb169870de57d31967494e1ad0b88df82415c3a6570057f02ad1e440a4c0e
- SSDEEP 6144:6YLtLTLDi42Nce9zsPLNEGLMNhGh83mH9e+PXS+wWqleX3ulvI9nHhbAq:j9TToce9zGLN/LMNhEafwS9WtXt8q
- TLSH
  T1D7C46C94B2E442F9E1BBC235C9934416F9717C4157349ADF02D48AFA0F33B958B3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Insights.exe
- Size 830KB
- SHA256 41a5a50ab4572dd27bc4b0a1026c7431042920345fd5b81eb0f1d965a5a0020a
- MD5 e23e8cc56baad88b43af75ee1fdc3b1f
- SHA1 8958fbaf2d74bd0440fe1b0cc2d935905017e6b1
- SHA512 6f049edec31a7b78bd5b49edd95b5bf11299aa0982107db5f128483aee20c16a2aa7861072886886b0923ab91e393fb9eb1d55a9d670a8abc6fc979ff363e45a
- SSDEEP 6144:Q96ONQptXojZStx1tafVUbq03TVglo2yP+KoA4fNx618yQ+7aNE7WGCt:C6OwXCSthWUbq03TWWP34xCQ+nKGCt
- TLSH
  T1600590D055BA49ACD066CD3C8A82CC9AF8EF7D0C573D39BB02B474581F3EB954A64E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  InstallHelper.exe
- Size 875KB
- SHA256 9e1134a5cde9e5daad1d0a65f54667223991123de9d430b9f9093d04f504e388
- MD5 4e5e0104576f11e702ecabb30524909b
- SHA1 eef1379880bd681f3b6ad547ecafef96119e2e2d
- SHA512 bb496f86ced7fafb2ac70b10d56881c6776534f9dbe359ba6ad37239597349df0908508bc03f21f7f681237ad9a58a5bf8b4ae7c9289f31a26d3c5962a10197e
- SSDEEP 12288:kKt/OU7GH/C8rtN0JFfWeG86yeLWZJhBlRq9J19KGZa:kY/OFq8rtN0JFfWeG81UWnjG1fZa
- TLSH
  T12615B1D056B649ACD069CD3C8991CC9AF9EB7D0C463D7ABB027438580F3EB994A74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral13 behavioral14
- Target
  LogViewer.exe
- Size 850KB
- SHA256 b2c48ceb7a834f1a07739c56b529b78460f1af74e17e00189f18e1303722a0f6
- MD5 cd90bd7694600e783fdea9cc5990c4c2
- SHA1 42a3b44c33a2f8c3a7238a64dd43b788e2207c8e
- SHA512 d81f8e5ba960cf1a90d9a2e1acf81366bed6d5721b6f97ed927ccce3ccc8b0ede0ce1402b3c34151040cffc7a8b2c9219698d330c3e0d7a38efd7303de87d101
- SSDEEP 6144:4XWYa4ZwXHV8YWrrQcOwIE5M7g1UmPTix0XkS+PNAScOWWv7eWmzipGqD4dGI9PY:I23cjhv7bUiES5VdzPIrbFaUz
- TLSH
  T1CB056C5DB69842F4E076D334BA824616EBB27C1577619ACB03A07B9B1F376E04F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ProcessGovernor.exe
- Size 1.3MB
- SHA256 ea338d4c47f61bb3aa107a26de3614d112f19da9438291b3a8212f21bb01d495
- MD5 6dedf57c5ea1f20667baf7a70f1ef58c
- SHA1 d060281475299d8692950bd16bead3846aeb4ce0
- SHA512 fb3880c63aa09401a9b6c184c0021f674cde3814df9d3054bb21c834655f7787fbb2d714fe45bbf2481f59185dd2ad7a1554c84f74eeaece2056e9ba8eaa8532
- SSDEEP 24576:6sWvHbfaQWy/JVB4IQd4uEma5X5ZehTbGL+vldvk5HgAEWmGzs:6jrWyeIQdhEma5veVbGsrVzT
- TLSH
  T1EA5528D416B905ACE066D97C8A81CC8AE5EB7C0D073D7AFB02B036591F3EBD50A79E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ProcessLasso.exe
- Size 2.5MB
- SHA256 2f6f1005b5d67a7e7468c66b106d45ac0e2537cbc82fb6b7edce3c89fe9a989a
- MD5 553e6ce129c3a3014b928b813fb33fda
- SHA1 7000f749ed23e68dd91535c77f1ac34d740a4b34
- SHA512 f4b3a5728608eddd8ac8920cd8f12b77129412ac70ccc0bfb5ea1b4e6c289d128c9310b2dd6f20490d77938111f43c7b517ac9d49e60094a17df713b5d4faa46
- SSDEEP 49152:nkIe/Smnix+rEPYZL4hRyAlScIt1/hCW3EAmi:xDooyM/dEv
- TLSH
  T1FAC549A521B801ADE076C57C89858D5BE5FB7C0D173979FB0160B9581F3FBEA0A38E12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ProcessLassoLauncher.exe
- Size 399KB
- SHA256 a9e6768c66f22c55ca78fdfb66339b21ff3e6414dbc0571685edbca94c27665b
- MD5 ca1b1f364ef1987ab72430e0dc58dd07
- SHA1 f7f63fec86efe6dbf5634c03e4e9ca4616509a2f
- SHA512 43356c274ebfe3ca80623f261d84725fdc74545ebc438739d43670418e08d294faa18939248b944f0ab2f35ade249fb1ffaa35e11a7e3378e3519913ca956a49
- SSDEEP 3072:1ja0CoxWjhPjO2pla3tLSkOnH1uwTa0zAugVxYR2k7HoZ7WK7TFXqC2SA:12lPjOF3pSBQucYR27WGhqFT
- TLSH
  T172943BD11ABA8DACD061DE7C8AC1CCC9A6DF6E1C463D363A4278341C5F7CBDA58A4D24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  QuickUpgrade.exe
- Size 498KB
- SHA256 863d93d37fcecba179fe3a74c1e5dbb9c55b0f5d5285921c4b82b948dcedda1d
- MD5 4fc38c4c91842ac5e7d9353e809c3ddc
- SHA1 6ef62ed367635656cd852d9fca0ea435061b58d1
- SHA512 34cb055de954059ae1af1035660596653a5bb9e649608d47cbdaa585c762979f0a4e0a85be665b44df5bd3beb074bac7156c9eed1281eda19eec5571ac4c087f
- SSDEEP 3072:XbxJawkF5xur4h9NIpEo4Cg9XL8atJED72cBDWmp9DO5y/Xe5IrI7/7Rk7HoZ7WF:LxJaPY4h0p+F9XLMv7rAUQl7WGi2
- TLSH
  T103B46ED51ABA8DACE461CD7C8A81CCC9A4DF6D0C463D7ABB0278341C5F7EBDA5864D20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Downloads MZ/PE file
behavioral23 behavioral24
- Target
  ThreadRacer.exe
- Size 308KB
- SHA256 ebfce32c39637859bbd4a49978bc45ff371ae28cec6f99b7c2a479b944712246
- MD5 1bb9a615ddbaaf3d45762f8886eb5f66
- SHA1 14f7ee0c9d74baae7c085cb7a622647104385ec0
- SHA512 45ed1848ee4d84b1fb4f6126525584288ea3b0dfa955ee855966ad25ce0eae053eb626f2cbebaa709cbda5fc9ec848c1a6329d2ec0da3bbec7e95191400ec27e
- SSDEEP 3072:YhERISyV0jwFrrvb6b48dgM86LIeNsOASbvT4PJbNlYO8agUr+RygPpUM2Zcebjf:ddjwRrv2nwef1jMPfOOQUR6KX
- TLSH
  T1C1641846A6A508E5F8F6803985929137F67E38550364DBFB02938E562F236FC9D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  TweakScheduler.exe
- Size 212KB
- SHA256 587946814b098868af5e0cae627bb3699bf536d1a44ae4d7bb7e9d242d4c6f73
- MD5 3aecd37a691d9258b6385161ce31dab5
- SHA1 06ab65fdafd43ed951f6a7742887d3e415b53fd8
- SHA512 34f10a1462a4eaa6cff4a84f58e17ce18a649f39a7a5dc30e3e6db9b1921d338f27ac4ea81fd7c3b568ec85773083127aaf456e7755b5d72f5cb673650dc37bc
- SSDEEP 3072:DDPylq6Hx3M4rxpntsXOf3aNmzldX4O4bA6my685bS79w2l:DDqdJdrxp8OfLp7y6ubO3l
- TLSH
  T1F1245B5573E500F9E1778235C9A14A16F6B278520B70ABDF03A08379EF276D09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bitsumsessionagent.exe
- Size 180KB
- SHA256 6425100982bf47c2ea13f03a5b14f0446af45184d119a5b507af5441787984c8
- MD5 28fde8a972a76670e7ccae1a164d1b6c
- SHA1 ca95499e75456bfebb71c4adbdd93c81aa22d979
- SHA512 5868a373e6f9fcde3da1d5013fc77302dfc1907e3ce8fd02f4b744c1ac9b22426821876471ef60be0034ecda39d8e2c5c9d99edf6258d1a855883f6d8478cc48
- SSDEEP 3072:gaNn5AwjVsJu3hE38kojLVJ6D4rXHnT5xH+HY2K:gaBWJuA23nD+PK
- TLSH
  T1B4045C5673E510F9E1778234C9A11A05F772B82207609BEF17B08376AF276D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  pl-update.cmd
- Size 40B
- SHA256 ab965ed0402b4c474fe6c988afee9957c5494c687745114fc80d1fb70fb071bb
- MD5 cd60ccd708d428df44ca1d454ad0d68e
- SHA1 83e3fb9ef19c7d3faabc0b391f96803652fda425
- SHA512 b400530473683de0f7cba3f206b38ba1a0a4d3156a06168c3db0391eb33be1cb6fa65e736c746067aac394d538fc35de8764c30978734bcf4e84392b3294c10c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Downloads MZ/PE file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32