ad3c0bc3ca459efe05a85f19dfb4bc38932a8371b61270946aac664ff7830137

Sharing

Copy URL Twitter E-mail

General

Target
ElPuebloLauncher-Setup.exe
Size 87.1MB
Sample260913-ccfwysbj2z
SHA256 ad3c0bc3ca459efe05a85f19dfb4bc38932a8371b61270946aac664ff7830137
MD5 77fca774cd92fa72fa654ee2a4d1305e
SHA1 2c6168ffdeeb8b65d315ea10610ec4408d782095
SHA512 7fe51f1af2feaf90fb4a6a61902b13f560db03929d85c610027dbd5c40fd99b21a4c24c56e3dfc5206aff7336d86b620d5ddbfa0b7eda2ba0ce8109ee733f413
SSDEEP 1572864:78kSyS115bfnrm0VRYdYUcHLllF2blpzDZ8/b1luBHzReQyYyG:78kSySX5bfnrm0gYUYLlqb7fE1sZyG
TLSH
T1FA18338595A49204DE182C381D9D9294C3BD77F3E3A1836F28D98BB134E4473DFE9AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  ElPuebloLauncher-Setup.exe
- Size 87.1MB
- SHA256 ad3c0bc3ca459efe05a85f19dfb4bc38932a8371b61270946aac664ff7830137
- MD5 77fca774cd92fa72fa654ee2a4d1305e
- SHA1 2c6168ffdeeb8b65d315ea10610ec4408d782095
- SHA512 7fe51f1af2feaf90fb4a6a61902b13f560db03929d85c610027dbd5c40fd99b21a4c24c56e3dfc5206aff7336d86b620d5ddbfa0b7eda2ba0ce8109ee733f413
- SSDEEP 1572864:78kSyS115bfnrm0VRYdYUcHLllF2blpzDZ8/b1luBHzReQyYyG:78kSySX5bfnrm0gYUYLlqb7fE1sZyG
- TLSH
  T1FA18338595A49204DE182C381D9D9294C3BD77F3E3A1836F28D98BB134E4473DFE9AD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  ElPuebloLauncher.exe
- Size 181.7MB
- SHA256 d44a179bacc9c3073c783267d1bf32dc4e49f21ec7ca3a9783c0de609ef5fcbf
- MD5 f1b6cc6878ada1f7aca7564c7f906719
- SHA1 08ad0a7907a0821b5b4dc1dea945ec3e63755c37
- SHA512 db1e12a64feb8a194413bb0c0d6cc566d4bc02e300b4a73755b3c3da66a0200a5bdb8ab349d49f888551013e11467bb95550495dcd369e680ffb2a0eb70c0bb2
- SSDEEP 1572864:BNKPIpfjC6kkZAC2TjEtxhyd5j14HbD6OaFSxqVUeu9Rq29EmoH7SesWVYpap+4Z:KY65t4TV
- TLSH
  T1DC988C03F39A40D9E01DD1758B8B9633EAB1B8854724A2DF275407562FB7EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  LICENSES.chromium.html
- Size 10.7MB
- SHA256 2f9bd7e8103b2f509abfcce2eac0a9e6a5e367987b8167dac612fd36fd3c0d9d
- MD5 b00daaa4e23ccb3860d572a0a73606eb
- SHA1 a6afe0a0dd6e469870f23a67652ace635879225f
- SHA512 9cc36d01722521bddda0e4bcc1ed14533b2af3e0f2548000cd0e71ce413d7b8fcb5fcdd997f32b70cd1f81dc32bbf59452a4d8ec19ad95ed70c0ae836332b39e
- SSDEEP 24576:2o9dQj6poj6j1qjK6DZywRFXTvmf4KjZ6ojK6QjZ6UjK6ajK64jK6ZjZ6ijK6e6Q:By8eGp
- TLSH
  T18DB6A42F7B48037706C602A2AB8B65CAF31F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 62937d8c1c2f7924d7369c08d15f8cdbb7dc4d1bdc5618ff5603fea873343a6a
- MD5 a31261d492e1663b1c15af4090c9d287
- SHA1 1c2982106fd99be54344ecb52f0a42827fbc164e
- SHA512 7de4b30355600f24f34e387b7d367e64c0a01e4028f55200e1c39e4b5e36a621281a5c167cda4486bc61d196375a7067180c1367a304d26f055f1dc8aee23841
- SSDEEP 49152:giWa61V7iv3L5LlZ1rpkKzYNOA/7ZnddK6BfeLaSHAIeSR3KTw8:vGev3LFbgKzYggIe8K88
- TLSH
  T16CD5BE03F6DA50DDD029D470979F9213F671344A8F1166EF26A05A202FA7FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 479KB
- SHA256 bd174fd289918d12e3d4ef63f5243e259bdfcef1aaab3613681544d2ef7e1efa
- MD5 fcc0a5c3d96a655a4f0271f18edb4e9f
- SHA1 e2cf48f1724d5210691ba75c30f608df95bdfbc9
- SHA512 4ba7d28dd6680a7696ac80df90cbf5934ca5534878b3b6585f085ad3e7dc04a6c9dca463b2a4a7af383a9b0bf0c9041da8aac3e556ebc3987bfacc07a8cb2405
- SSDEEP 6144:Xpf5tkRT05pU+7XmpChszWpTRY6CIczyj+ww4NZ96gRO:tx537XQChszIzCLyj+ww4Ig
- TLSH
  T155A49E15B3E444A9E06AD174CA534642DB76B4960B29FBDF03E492392F37BF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 66788a90b70bafbecb5b1292ed83d98639b58a5b1a5c090170f7baff59da023f
- MD5 3cd55d16c2a54b81f3a3a81dcf15cf73
- SHA1 83ce14ca1c117ff9535da6872d218462c502b3db
- SHA512 e40342b38b71b50b957544c0665c3170b065755d2fb718c4d2d4ddd1a13a6240c8259ae54ef6fda043600eb324ed817f96ecf79d773c9285278e07822d3c1ebd
- SSDEEP 98304:8q/cBzNls5GKtT8jbjevNn+y+vrrXgJooioooooooooooooooooorooooooooIn7:8/sAMV+n47
- TLSH
  T182867C03F79640D9D00DE2B8C75B9623FA3578850724B6CF269457252F67FE0AB3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 bbed1f5b6c20266602188127fa5f5643cd11d6f5f20494ebacc49da1c0ed70b8
- MD5 b0c04842e116baaf600203e92d119940
- SHA1 69e23ac3d871883557dcadebbd2fb110de42a90f
- SHA512 6edd12d3808c9a2ec970ba238d4954a409fdb18cbc3d9b235b7f749b59b06be3c2efedc608f3c3aedb8facf19fd67409502fa74c4d84be6185083a5501c8e1d1
- SSDEEP 49152:zjtHPuQzKxUDrpspreFRHmrR5zLIOrzY/9G75d/9N4yyUGrWrw+/1SbJ/E06922I:1GQzcXpovSnXNk
- TLSH
  T17C463803B2858099F05DD679875BA633F632B8801B76B6DF52A01F192E77FE06739B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 876KB
- SHA256 de8802db77e0d421a8fabb636a7102fbac72d229b0a3e82d08b26812d36b3d31
- MD5 b5d3aaa65250e13e04b3171944c81051
- SHA1 34c45be968205c785fd515321d3f8f4ba800ca13
- SHA512 28d6d68418e28f59946a3bd4fab871e8b473150d26d03721a8697de36666231b9224c7a381084678ac0194d69a80d6a6c26b33e953b7ae1dbbf6bcc0e66fcc6f
- SSDEEP 24576:qx2LdDMxavyLgu/QYkiawQV6Z5W4DYsHF6g3P0zAk7oov:qcL+xa67/QYQwQV6Z5W4DYsHF6g3P0zO
- TLSH
  T1A0156C23E6948669D57AC034C9C24603C9F174922326B9CF02A85718BF6BFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  $R0/Uninstall ElPuebloLauncher.exe
- Size 136KB
- SHA256 aa347ba21ebcde93d063e743f1cdea08400bf293dba8da8908973cc267233d05
- MD5 92248ccf18ba6965cd38f692a57e0e23
- SHA1 c1be9712237cb8c35c9f620f86619477d3f54c11
- SHA512 178014d6c2940b803a6f94faef0526b0b693dae4dd64fd5288058cb233920f31c147a016e9e0668c04b564c2b5585d83c41b508a154ea111bf47b0f3f85383ed
- SSDEEP 3072:In77v00hEoDEtauwceATmwio4FCqwfVdNaH2tvhOEA1RJCir86SrSrv6Ia3w:I740IgmTN6kdNs2t0EyL+yaA
- TLSH
  T13FD3E0117BA0C467E5FA4F710BB697AB1EB6F51128244F0337C06B6E7C626A0EE0D752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral26 behavioral27
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Discovers running processes

Checks computer location settings

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32