1463121e390e22c8f3cea0cdc70943d403e48f5380d3bab0d37b10479c0b51d2

Sharing

Copy URL Twitter E-mail

General

Target
Krypt-LARP-Setup-2.0.0.exe
Size 74.6MB
Sample260909-hsprpattgs
SHA256 1463121e390e22c8f3cea0cdc70943d403e48f5380d3bab0d37b10479c0b51d2
MD5 47566ff09b5d5799459e74d768393f4a
SHA1 3263035ea420cccee048c36003b6a6387ad4605f
SHA512 3e37c1b3ffa8175cf35a79b7034fa645b9c1a66ca71c71d09d6869318fe8b62b05170a78cb99c3c09c3be0cfdea6ba7935b30dd521c7323b794f7e5882ba4f4c
SSDEEP 1572864:rw2um4Ndc2kuM1g5CFZtJttVyt7UQnhoDO2wGuMqbCXYtVmnmKOY7:rwTm4PiuMKCH1yVN6DATMU7MmG
TLSH
T1F2083390F18B1C51D2C26C3B546C1DCF46D5B3229AA3F65D877F32BEF3A3954A6A0242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Krypt-LARP-Setup-2.0.0.exe
- Size 74.6MB
- SHA256 1463121e390e22c8f3cea0cdc70943d403e48f5380d3bab0d37b10479c0b51d2
- MD5 47566ff09b5d5799459e74d768393f4a
- SHA1 3263035ea420cccee048c36003b6a6387ad4605f
- SHA512 3e37c1b3ffa8175cf35a79b7034fa645b9c1a66ca71c71d09d6869318fe8b62b05170a78cb99c3c09c3be0cfdea6ba7935b30dd521c7323b794f7e5882ba4f4c
- SSDEEP 1572864:rw2um4Ndc2kuM1g5CFZtJttVyt7UQnhoDO2wGuMqbCXYtVmnmKOY7:rwTm4PiuMKCH1yVN6DATMU7MmG
- TLSH
  T1F2083390F18B1C51D2C26C3B546C1DCF46D5B3229AA3F65D877F32BEF3A3954A6A0242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Krypt LARP.exe
- Size 168.8MB
- SHA256 457dc2f1b1f3d90c38652e619e0e7e158f634c40cdb879ea5f99523c39a941db
- MD5 4e1f060d3c4e8229eb197b1e3fba15df
- SHA1 469269e9015ba003e26bb6afe605bc93dcb1c899
- SHA512 387ee9f076c50cceacdd6b7e41a6993ccc0083c6c6c57c32cbcde6ada6b4a8635302d1cf43e5cd343132da0fcb1c01dc69d6e3ac424716f9f72132d79d232fe1
- SSDEEP 1572864:TMw5SJUgPbksdRW8YcrVEGPv/fNsYCdwl0KWCfLM14GYoQt0imGWgyTpQGa:3unRK2agyVQ1
- TLSH
  T1B8888C13E29A50D9E00DD1B187879233EA72B84A4728B6DF2B5447563F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  LICENSES.chromium.html
- Size 9.8MB
- SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
- MD5 0ff177fbf2a3873dd573077840e0b8f5
- SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
- SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
- SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
- TLSH
  T134A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
- MD5 7826cf6f81ef54e9fece6a9d5a0b7bba
- SHA1 17f0ace5f39dc276790ff4f427f3112de9ae9baf
- SHA512 1db8e1fb6da58401d384e26e9353e5461ccb8d5a5d98fe1cdd43455d3813358b3fcc010d30090f78c59d739a4bfd84a77a0c4eaffa4f270460964301d5c6f4db
- SSDEEP 49152:VC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x:ChOVYJiUOWwQaPB
- TLSH
  T1F4C5AE02E6D904DDD02DC0348B9B9223F63174468B24A6DF1A91CA253F6BFD46E3EB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/.eslintrc.js
- Size 2KB
- SHA256 7002d9a81ab28e145de657890a69203643005155c0ae152492e770c7a13e8def
- MD5 5209425051759d6e1234066b6d03211a
- SHA1 5ad80d772bec9948ebf744507c31576dbbe5b8a9
- SHA512 4b973b685d4308afc0d779fce567cbc65370e9906d5bd3a19196aad15dd3d13e179feea595a9cc3ce66075474bb9193aab72a0521291c5b6d0fdb6b27e2c68f1
- TLSH
  T1FE417CA669BB403B196593BECD5E9523A6200047AC3D3C34F99D06402F9C2AD65B6BF4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/browser.js
- Size 47KB
- SHA256 6032495a2f445685607d08b0cadcd68c2809a5264d5baa41b76ad64b01e87c66
- MD5 cfb9ad790ce51f1b1927d09c72276379
- SHA1 97e62815f8e85d6f4b4058ebb7a5a17cc7b3ac7f
- SHA512 8273a4893f8fa32efbb380422d40efae8bfd91476ecebdc25538f3cf960d15365eb6561a5c8219b476f2dfa9a0e6c356177c7554ee715d439b3f32ce5bab7e48
- SSDEEP 768:s/yuha9kJ5pCxm/HZOPURqV5G+fclVGodz/gMy8hRrCgSl/c3lc0sefr7vrW7jKg:EK9kJa8ZL+Oy8hblcHiWr
- TLSH
  T1BA23D788F3B5B07113E762A5502B500BF135E929740E48B8F225E8E57C789CEA57BF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/client.js
- Size 18KB
- SHA256 eaff1c043bf0c996d7a53a578011e38a78e301e422490585907bdabddec2326f
- MD5 e801592a9164b88322909fccddfb54b6
- SHA1 87e039fc73fa130c48ca3e0603ac67de6d918014
- SHA512 12ee358e99f81c0ce36ebe4e15f96786a8d9d9de5b5225dff5e03e3c8acf70ae4b349f56c2cec97fa9a56211152fad560abe2f0e9c92064f13561c03464bec06
- SSDEEP 384:kEkg20b8XdY5Q5/R6MwlOHpOuBAeZvVIebIbaAIq0Oa7Zr5HYuYC:Wj04wGeWz/
- TLSH
  T17382A9CAB6FA11E2426360756F9BA683F125F10F390A5CD5786C37E44F5D33882B5AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/constants.js
- Size 3KB
- SHA256 174db6e530abb29e1d2705cfbf43569e35f1972176e8c4ed405f8ee6e63dfd0b
- MD5 d8c53237370210cb540c816d2c3231ba
- SHA1 0fc4c54864015e5f97ef5995f4128c7937bef0da
- SHA512 e7314e17042b8a9d8e9a283ee40fd67711a718bd838780d66cac7e02250c2fd27151326a2ebc6a621cd1ee85be51f875c2a94c7eef1f5f17d7ed8e26ee556ca8
- TLSH
  T1E98100F3226526EAEDAA1A3A203C09447C21D31F65DB3CBD91220555985FF07CEF49BE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/index.js
- Size 166B
- SHA256 807f3c2a7d1b380cb73d423f325978a7b33b0730efc7e0885813bef0bc032713
- MD5 79e518ef097f0dfdbf03a08a400bf0e7
- SHA1 7785a8b24a9f18fc3185e7b72cbea11b1e4f8a2f
- SHA512 c5a5121b54046495e6d6113d3a51090690eedd5f6d23fc7fe5d930e5af3d3413f77cb547f86e5374e32513e1f8d9bfbc25ba338f9181bf46fcb75632f2130111
- TLSH
  T11DC0805D5FF2F1271B5B56C8D607C4017097D551110D5904E65815DD04C55CAD178CD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/transports/index.js
- Size 99B
- SHA256 293dd7ea565428ac11311683763713b0b7f76e6ad2d1adfe91fe1b410494b678
- MD5 2f7688f275a929f322478d9c7655d91b
- SHA1 8613f4b6f7eec12cc5bdc0e646900ef795b35dc9
- SHA512 0611ecceef0b76b47e16c8f0a330e8b4d98d6c1efc527f8cad3d51636f4aa17b370d3f181d414a22f5a6add78ee6bcf4ab10a9f523d1d0ea1d13e2e49d163e07
- TLSH
  T1B9B012D71FF8B2CD325483C09006640570E2C060090C548D45A47CC9908DC881620C7D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/transports/ipc.js
- Size 3KB
- SHA256 00c165347303edb40a65340910c2157f79be4e5a9d3440cdef8db0e2e4891dcc
- MD5 cdf4dab7acdb1ddaa2764de1d5f2c36f
- SHA1 7bcb981ad2ba62e4ec76de7d4fc65abc3edb92f2
- SHA512 5e1b958c8553d878588479675514f36ef1e0cc06b9b5601fb0df4a784e87274981158911b152fdc50cf2436943c0b85990c7f7402045f6ea94f00fc724baa541
- TLSH
  T1CE815644B6F7186441B7B1260E4FC412361AE01B215ACE157A9C8FD4AF5D078AEB1EF4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/transports/websocket.js
- Size 1KB
- SHA256 5b97b43cd54354dda86e7e813ae412c21a6d75d5797e36ad1d68cec5f19c04bd
- MD5 f7556481579c5bb049b37dc750cf7218
- SHA1 bba42d819edf9c66e3e9d3df5f31b20b4b330f0f
- SHA512 83dae814d14d081ccb822d9d245aeda3e26b659cff8a1cdd4c1b4344fdc6725c7c8a31b633727d03972e5f932d7d0952090d229fa98b45b576b037f419518a64
- TLSH
  T1AF318D0467FE1424D1B771AA8F8BD4037228445B294BDE59F56C5BE88F465B04630EB4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/discord-rpc/src/util.js
- Size 889B
- SHA256 c52042a1ac2ab16f7e318673b85f195e85f078b3056d0993b97bc92748696719
- MD5 e44af3edd2906a749be96eb568157084
- SHA1 d9756726c78a396bdd8a3c837573e33b3bc904fb
- SHA512 74f549d03737de277fa21f0f59e6cd6794ca909125af1122471213efcf6c01ea0400805a4f7d623c55927715e2d7e5668cb817ae79d50b1b2880664cebf76a4d
- TLSH
  T16911AF997BF3A03B46D6B45D0E8DA001B42DD47312AC8D50FB0C66E2AFA342C63F2784
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Network Service Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Adds Run key to start application

Network Service Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32