Overview

overview

9

Static

static

9

EXM-2.2.1-setup.exe

windows10-2004-x64

9

EXM-2.2.1-setup.exe

windows11-ltsc_2024-x64

9

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

resources/...ID.dll

windows10-2004-x64

1

resources/...ID.dll

windows11-ltsc_2024-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...vc.dll

windows10-2004-x64

1

resources/...vc.dll

windows11-ltsc_2024-x64

1

resources/...vc.dll

windows10-2004-x64

1

resources/...vc.dll

windows11-ltsc_2024-x64

1

resources/...te.cmd

windows10-2004-x64

5

resources/...te.cmd

windows11-ltsc_2024-x64

5

resources/...te.vbs

windows10-2004-x64

5

resources/...te.vbs

windows11-ltsc_2024-x64

5

resources/...on.dll

windows10-2004-x64

1

resources/...on.dll

windows11-ltsc_2024-x64

1

resources/...do.exe

windows10-2004-x64

1

resources/...do.exe

windows11-ltsc_2024-x64

1

resources/...sw.exe

windows10-2004-x64

1

resources/...sw.exe

windows11-ltsc_2024-x64

1

resources/...ies.js

windows10-2004-x64

3

resources/...ies.js

windows11-ltsc_2024-x64

3

resources/...cmd.js

windows10-2004-x64

3

resources/...cmd.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    EXM-2.2.1-setup.exe
  • Size 212.2MB
  • Sample260910-2xmbxaxbqd
  • SHA256 299c7b00a39bf755de1f5bdfd296ed1434995aa3a7e3c438c9674439f3b43eec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Targets

    • Target
      EXM-2.2.1-setup.exe
    • Size 212.2MB
    • SHA256 299c7b00a39bf755de1f5bdfd296ed1434995aa3a7e3c438c9674439f3b43eec
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecution

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Stops running service(s)

      defense_evasionexecution

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Modifies boot configuration data using bcdedit

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Drops file in System32 directory

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 14KB
    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/app-64.7z
    • Size 211.6MB
    • SHA256 7eb0b85939b30dc4784d43265bc42978156c8715b94f48568b263070a8fbb929
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      resources/app.asar.unpacked/node_modules/@0biwank/gethwid/build/Release/getHWID.node
    • Size 141KB
    • SHA256 406b4b003575b6d8be635d72c48e120ea7ce62052259f76b61025f6107cef0af
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      resources/app.asar.unpacked/node_modules/@0biwank/gethwid/index.js
    • Size 562B
    • SHA256 f3f577d3911d3371c86d9aebbd8dc0771d42643853b786b96bddd3567a3d8aee
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      resources/app.asar.unpacked/node_modules/@rollup/rollup-win32-x64-msvc/rollup.win32-x64-msvc.node
    • Size 2.5MB
    • SHA256 58e08ebf47caba5224aa30bb94d75e9faf82e2b3f7264ccf6e31f9aa74a943ec
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      resources/app.asar.unpacked/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
    • Size 8.6MB
    • SHA256 6c899290befbf6ae66a9849460defae6d49dcfe14d5782db581777b00db8e167
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/bin/elevate/elevate.cmd
    • Size 80B
    • SHA256 d3d046aa4e54c8e1aafdb95b0d65aa73731a7fa76df3bd582c26244dcebb97eb
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral19behavioral20
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/bin/elevate/elevate.vbs
    • Size 334B
    • SHA256 f7ab6e0f5ce0b0da4169083f6d8832dbe4ead414ae1f450fc75f873490c00b7f
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral21behavioral22
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/bin/sudowin/Sudowin.Common.dll
    • Size 20KB
    • SHA256 ab3f0d95abc0041c4413a52f42447d4a49f2f09b746b78c297449880206cb844
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/bin/sudowin/sudo.exe
    • Size 20KB
    • SHA256 922754cfe2c6cfe1dceeaedb74fc00367e9613afd0ad8c9e42ec80a81d04d49b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/bin/winsw/winsw.exe
    • Size 58KB
    • SHA256 5859b114d96800a2b98ef9d19eaa573a786a422dad324547ef25be181389df01
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/lib/binaries.js
    • Size 2KB
    • SHA256 bddf5f1dac004390c88b08d637110a512ce43ced65fea33997dea4fd2022c268
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      resources/app.asar.unpacked/node_modules/node-windows/lib/cmd.js
    • Size 2KB
    • SHA256 21a33da441ed2c888d912fe8551f172a90ce138cde7f01e49b1157957f6ee485
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Impair Defenses

1
T1562

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Credential Access

Discovery

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

Score
9/10

behavioral1

defense_evasiondiscoveryexecution
Score
9/10

behavioral2

defense_evasiondiscoveryexecution
Score
9/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

execution
Score
5/10

behavioral20

execution
Score
5/10

behavioral21

execution
Score
5/10

behavioral22

execution
Score
5/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10