6ba94c901619b55408167f7198455bb5a5753e3e54d05528f9980ecb2519ca38

Sharing

Copy URL Twitter E-mail

General

Target
Hwidspoofer.zip
Size 139.8MB
Sample260909-sgccbsysfy
SHA256 6ba94c901619b55408167f7198455bb5a5753e3e54d05528f9980ecb2519ca38
MD5 d32ce5369da20afe8094f66c62cb916e
SHA1 cc012e934651ed95fa37436272c94ef75522a4a2
SHA512 b6bab49e607f1a8bdda847490bf380b83a5e7d32d9f150bba5b3452e41ee8b1daf945a59864a11be8eb07e17ee1f4cf2cb4b8d61778959e1cc10e0a569eb1701
SSDEEP 3145728:c0Z9nWvAb+LA6e3tQNrqVO9ct3AhlUh9dGNgqY4E4zlR:LWIMGQNrqA9cPhnJkn
TLSH
T11068336183A4DC9A5737A437235F7F30DE181663860C5BFE6A8067B18BA17EF183415E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Hwid spoofer/Hwid spoofer.exe
- Size 139.5MB
- SHA256 b11eeaaa87fa97d28a590e926cced0bb41e70508638d88c45342a3df89c8f13d
- MD5 7ff6d00335083fef1d5673c15cb7fc6c
- SHA1 ecf82ac2f3ebdac53763448eec89f660e9e49663
- SHA512 a2cba242760c9accc94db2551927a3dd6ec282c10ab79e4424291b0d5f99f8463529e1eabf967b2f28537ec0bd3c5c4d57476fa7abd7e8687b44315265bb216a
- SSDEEP 3145728:VsQPl6NP3XdSeQAtP3lIRALehjUrH05D7s1gCE+rE/Lc4:VapjP3lIaLeH5bVzw4
- TLSH
  T18568335153E0CDAAD7329437934B7F60EE2843128D0C1BAE6A9175B86BB17DF6C3809D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
- MD5 aaea51a605688fcb2f178fd60e4ca64c
- SHA1 69d4791bf3cfedb68bc4d8f766878103578171cb
- SHA512 d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp
- TLSH
  T13D96A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  NeverLose_FreeEdition.exe
- Size 171.9MB
- SHA256 9635c41731161c84037f2ef3d6c63bfed2a68dc780e2f10a17a54bdb6d06d249
- MD5 3620214704bf767105c87abac52095cb
- SHA1 57bf0ea58da441508bd50f2990f5ba1df29f5ccf
- SHA512 f5d23d2c8563570233aa0f99823cf4249d15d41cdaa1f309fac0d8fff4da251ca22ed6c3aac7eddfcf996d1cda4e6260f3b890e5b855f54f980048f7082886e2
- SSDEEP 1572864:9asGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4NK:l4fc/M+i6xCLd
- TLSH
  T1A4888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 604de5c5b2d25c731e01d0c08b8cb21c872a886ac1f6d3e3c13e8b29f84a0f93
- MD5 8744d7d11205686e96a2daceee93b599
- SHA1 b99617736f81d35d5750e1a60a21a6d82fab7107
- SHA512 de94a92f2fbd3a1a6accfed52f3673e9a4a207cc496d4c58c072ada7bbb881fdb38d94b7c4b3d2a4865fbc86d50b1b8ea3d55e7d3386a8d52d92dc47398754c9
- SSDEEP 49152:SyjmWBbBFCP9qLFBgpxcW69m8qvWen6yfmbhAj9P6xmSB:SQVLFB4Em8qvnPQ
- TLSH
  T148C5AE02F6D640DDD029C0748B9F9613F63039468B24A6EF1A908A243F6BFD46E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 470KB
- SHA256 0152aca7a9865b7cae2c437d85d6c771a16afc9da2929ddb49eff9cc70b42f62
- MD5 d3de3d21843c6dd1c17c806e4acc7244
- SHA1 3492917a2e8c5788d18735262aae71e4543bb996
- SHA512 c155471b412fdd83ab7097191aaa62af74e3ccd1f411d9c5f19f6207e5aac81fc657559f7d89a4387c1ed20349f46d22feff107d1f388fd2870d64b87fdcb953
- SSDEEP 6144:5mt12qlTgeUDsnkcM2nDl83BgENhYCqNvfY24M:5mr2qxgeUDsNnDcgENhYRNvfU
- TLSH
  T1E1A48E15B7D444A9E02BD134CA534642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 c5f86befae432c8d0b8942e7cf24a4b5c307e7fd421eae248946e81381cd62f3
- MD5 8a23945fdf08b1e32b2c2386577fe6a9
- SHA1 2215f8c3b0c1ae47deeb83f0c98069a8725f0532
- SHA512 5792fdfb183f5721be83536a26f27a7bd9ab1977f012f1de58aab2a40f65663681729b86e64d57766b2679b99d12ee34742639b66c00a82a2f9a43aad0fcc45a
- SSDEEP 98304:yPD6gPqLuiDsW/w6cGEmC5f1/hIvQrOPl/gXC3C:yPxqrsW8f1ZSQOymC
- TLSH
  T176868C03F29680D9D04DD2B59B5B9223FA35B8850B34B6CF265413152F7BBF0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar
- Size 8KB
- SHA256 9ab41086d1dbe068676933a769b61b6e4e1fdeb5dd31ec5a65009593e2aff87e
- MD5 ab4ea19b29ac4162563ae8fcccc77ea2
- SHA1 76aa392fb00b0f288e5dfcb2dd7ec4517e102b61
- SHA512 2e6748e75b3aa0ca022cec72ee0a89e152d4f3e7387f586cbb94903f306fe0a0a385c12cbd527e84be086b8c6d64d4ac4dabdd05b9c4ca0e884d4e6e1597e85a
- SSDEEP 192:JQp8s+PSpwBg+2nTfMEzOYuNl1Jn1E2N15JFSqyxgcnz7wKRUo:JQpvwBgLnXOYuH1E2NBPyxVhRUo
- TLSH
  T19812A84572C02851130B9BAB7F26A1E1EF57459A35C80CDFBF0CB985D97891AAEC3E34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  resources/java/125fba09b1cb.jar
- Size 25.1MB
- SHA256 ef043fa3ada7e860aa54e501cbe1343b87ce27e271a76f65d179f730be481467
- MD5 e1be91d2946daba5fb1cf8f654be1ce3
- SHA1 8906f3718a6802da193317cb1014e52c410793fd
- SHA512 47d2a94b032ab074dc6f7ab3bdc213d77e258fedebee8867a31a3d468de69ec349917a5b8ceda3bb82b83ccede55111ed4af4d239b9b3f5a70663ebfcb7be77d
- SSDEEP 786432:ZR/wPCqi51818NrZXXH9KzxBiu750lWFOy:Hwqfrk8NrdH8Biu7yS
- TLSH
  T1FD472336BFDAC929D96342B352CA8157602903D9E81AC0BF0BF00DD95E71D4A4762FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/java/jre/bin/api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
- MD5 9f746f4f7d845f063fea3c37dcebc27c
- SHA1 24d00523770127a5705fcc2a165731723df36312
- SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
- SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
- TLSH
  T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/java/jre/bin/api-ms-win-core-console-l1-2-0.dll
- Size 21KB
- SHA256 c062477ad3bfdc57b0cc402179637a214dab5045c8d644592c7decca7d18aa50
- MD5 5ec3ae03796fb3d461690cf679964b1f
- SHA1 2b1977edb9c4d609ee77320464a1514053884851
- SHA512 b160a5b1fb1e5fd95fe6cd55b64427bb3f39e1d30484743807a18443ce2f90203d5319d75f3d0cb0744b1dd21171ff82cbf4e4fc3141ac3d7abe40937fd8e647
- SSDEEP 192:xGDWthW/WEXCVWQ4OWLtugx6RMySX01k9z3Au1tUkL:xsWthWUgYMR9zv1tN
- TLSH
  T166A22A939DFC9503FC9AADB056E8E9537C3DABC70A00606625E8F54C2CD3391AB2472D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/java/jre/bin/api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
- SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
- SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
- TLSH
  T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/java/jre/bin/api-ms-win-core-debug-l1-1-0.dll
- Size 21KB
- SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
- MD5 226a5983ae2cbbf0c1bda85d65948abc
- SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
- SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
- SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
- TLSH
  T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/java/jre/bin/api-ms-win-core-errorhandling-l1-1-0.dll
- Size 21KB
- SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
- MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
- SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
- SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
- SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
- TLSH
  T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/java/jre/bin/api-ms-win-core-fibers-l1-1-0.dll
- Size 21KB
- SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
- MD5 b5e2760c5a46dbeb8ae18c75f335707e
- SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
- SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
- SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
- TLSH
  T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  resources/java/jre/bin/api-ms-win-core-fibers-l1-1-1.dll
- Size 21KB
- SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
- MD5 050a30a687e7a2fa6f086a0db89aa131
- SHA1 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
- SHA512 07a15aa3b0830f857b9b9ffeb57b6593ae40847a146c5041d38be9ce3410f58caa091a7d5671cc1bc7285b51d4547e3004cf0e634ae51fe3da0051e54d8759e1
- SSDEEP 192:x8sWthWXWJWadJCsVWQ4KWqSY00pyEuX01k9z3AxzIsZ:xLWthWOCs4EpcR9zwpZ
- TLSH
  T130A23B829EBC4143FDABAE7043E5DA873C3D67C71D90A0A61594F59C1C973C4AB20A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 938KB
- SHA256 9772ec778911124af85619663f6a78eb0596860a6c27e3e03e9eb0a31cea1cf8
- MD5 6610fee2c6b693a8c360440d0a4d9948
- SHA1 de8d3dc3782e04780ba2456a5215f951aa9d03fd
- SHA512 6b4862681a32c2c89a5653b3aa96ef23e1c5220d459ede855059487cc36fa7ebe6b2dbd0290292305ff259b9f3305aab583cdf87aa67abbcc11ed3d7f7d79dfa
- SSDEEP 24576:RawxZ1onv5SpQN9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:cSSApM90IDWb36Z5W1DYsHq6g3P0zAkw
- TLSH
  T18E155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Loads dropped DLL

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32