1aa211329adf1f187e761b63581b187364f81abdef8ba40a59097589a61246d1

Sharing

Copy URL Twitter E-mail

General

Target
Monotone.zip
Size 685KB
Sample260922-yfjynswt5j
SHA256 1aa211329adf1f187e761b63581b187364f81abdef8ba40a59097589a61246d1
MD5 e6fd29188087a3f4bdbd4af68fba9400
SHA1 22a7bc68c313b219903ed8ab18280c2e72fd82e3
SHA512 08ddfaf0aa73aa4baf22ad23dae7bd32501bdcc52ebe1209f6452da7a707a1049d0b10c0317ea06f84f571bc0450710505c7abf4f4752b699c355208039bf437
SSDEEP 12288:aKSmTFPvU4UE33I7xmRjJiulBy0WGmUP0asQl5kJOt5iO+0ECJA7KLpB4JiB:abmpXU4rHI7xSiuWDUqI+0tgrBCJCY7j
TLSH
T157E4236C8C355534EA4B6EB14D85A2D0E9FAE2C5BA4F702624C153146F2DAF8790CCDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Monotone.zip
- Size 685KB
- SHA256 1aa211329adf1f187e761b63581b187364f81abdef8ba40a59097589a61246d1
- MD5 e6fd29188087a3f4bdbd4af68fba9400
- SHA1 22a7bc68c313b219903ed8ab18280c2e72fd82e3
- SHA512 08ddfaf0aa73aa4baf22ad23dae7bd32501bdcc52ebe1209f6452da7a707a1049d0b10c0317ea06f84f571bc0450710505c7abf4f4752b699c355208039bf437
- SSDEEP 12288:aKSmTFPvU4UE33I7xmRjJiulBy0WGmUP0asQl5kJOt5iO+0ECJA7KLpB4JiB:abmpXU4rHI7xSiuWDUqI+0tgrBCJCY7j
- TLSH
  T157E4236C8C355534EA4B6EB14D85A2D0E9FAE2C5BA4F702624C153146F2DAF8790CCDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Monotone/Box.bat
- Size 5KB
- SHA256 64556d24498bcd280cd7cc248a98ed22c4db921495d825f141af1547c8fdd275
- MD5 a95505942d3ebcf724f080b49d4e981f
- SHA1 ed7202c5dd386d050a2a24745399154218569f81
- SHA512 21046716caec7a2b26516ae37f3295445d8c7f1b3502ebcaf41a84469bea1888f0139e813111f1585eff9b27403674e4c61ef4d4a62503f2c1dd820bde8a3476
- SSDEEP 96:0hsAkUFjSl445cLegeOGe1fjlV/SkJwxwotwb7MEussvil2YTUK:nAkQjSl44yveOb/Skxt7WisY4K
- TLSH
  T158C156017158335B51F506BB407670E4EB3CD1932B3AE7ACBD2A589B211D57DB0E9ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Monotone/Button.bat
- Size 5KB
- SHA256 38aa0c1ad69d96732c776cbd73275f5ccb881d42158158b32815dad869ef9876
- MD5 96fefe69f2facf74197a8af3004a6167
- SHA1 80baf02b5d984dd8055ac3a6f42593ad98b78307
- SHA512 1aa6335a5cc340191613c52fa3e55625ed058abad8bd8d5ed1575bb9cd59b19e1fb3fcf3f5df199ea6f9b9d10bdee45e099c9247457b35ea65c7b1e403f0e888
- SSDEEP 96:X1UCLtcZQBjROHl4EF3r+QOAwD3MMcEzySfuP0wOYwwYW2s:XTeGBlqlXF3yDcMJ2+uP0wuwY7s
- TLSH
  T1EFB1648971453363A2A2215A1D4F94B1FF2AD8B0767A7E59347F00DD02868FCA1B9DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Monotone/Commands/Hidden/Adapters.exe
- Size 335KB
- SHA256 b3de6d10d9f94037b88f736609e50a8a4c4d516ca50107dedd575797a654c28e
- MD5 934bbc5411c532964f3bbe42cb1c1785
- SHA1 dcddde340e7f080716abaa456971b9aa85bd084b
- SHA512 8db126cb8381fe84afe25b25e854eb8de25e43f2638e0d87740ce3fe33338b032b09d9551655afedecfe39cb7482f88e72ccdb28afb59684474084a28da71cb2
- SSDEEP 6144:QlGlXIiIGWbsTXO/P/bbUmmUhquD2S6FEJQzZnCvTkJCps9Q18RQj7dVJTrQkEj2:QlGlXIiIGWbsTXO/P/3mUhquD2S6DzZl
- TLSH
  T1B6746A1AF76504F4E973917C88568686E6B2B8160B71D7EF03A4431E2F376E09D3BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Monotone/Commands/Hidden/Adapters2.exe
- Size 341KB
- SHA256 4c831252aa6f193c4474ba74f352bee7d00099dfaf5ac6e98ab1253e21999b4a
- MD5 bb36d4578ce201dc932ab6bbc079875c
- SHA1 f614f8211bba9d578eb19e7d96a0314b5a51e662
- SHA512 ea66cffc96403f69f1b1a3e4f7b0c2fb5045655e2f10772f4d0e5dc9d0243e99c972ae9247c597de680ed7886896a335bc82dde8b162515f15ba368ff25fdebe
- SSDEEP 6144:zlxFkdqBBydxtri9gvdRWKPmawYItN6atI/cFVygZnCv6hqGPs7fYv8dMQZgxiQT:zlxFkdqBBydxtri9gvdRWKPmawYItwax
- TLSH
  T1A8747C1AF76504F4ED73823CC8628686E6B27C1A0B71D79F1394461A2F376909E7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Monotone/Commands/Hidden/AlternateStreamView.cfg
- Size 551B
- SHA256 2e44dad813efa86ddbd849a53962c5bdcacc9bcc2039dc09bcb2c25c770f3d8b
- MD5 d298348206017d0cb04217887a677334
- SHA1 8fd2cf9e5e39213c5316f36b463948c52ca83017
- SHA512 517a9d78ba3529308066d619a11d8a3684aaf7428041fae2eb8520f30fc7ec9553f6f58011b63bce030391c2d24fb7b5f7385ec2da21a51ca1264dc7a513b5d9
- TLSH
  T16EF0E202480F205CD092AF5C96F87A3001F05C5335E05CFA57DF6B94DECDC8A6A45440
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Monotone/Commands/Hidden/AlternateStreamView.exe
- Size 109KB
- SHA256 669ce40107a2e05fc93dd37df55c77eb155705b449b2e236423e8bb96b9985f0
- MD5 caede4f12ac17f3e0ad8e3c923fd510a
- SHA1 107616433f973110664ceda2ca64c21fb7a92825
- SHA512 69898a4d39ba4415da8c8e5eb8a1a012d4db87f24e61f63a50b3af07e65d2aed6cc4b24ed315e5a20dea91fa1903fac92a5eefbbff8b8cb90c7259413cd93162
- SSDEEP 3072:6SuY8BQkSJllKctuKvF2CIlMd1krc1uRCiOoCW7ZlFzG:E0wY25facROh
- TLSH
  T1F9B3398663F806D8E86BCA35CD724A27D7B0BC955934C72F07A4DD8A1F63361BC24726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Monotone/Commands/Hidden/Block.exe
- Size 119KB
- SHA256 dfd08e1d7a34bae6836b3915b45b8637b85cdc998198c5bf148fba5e96f15c21
- MD5 5782b8d469bbc9045ebd2316c2aefbd5
- SHA1 f679adea19ac0e88a50cfefb88825a086102f77d
- SHA512 e57ed92d3c916b89e5f830fb52a63b330e404ea91a7cc0e0b0e8cfb03f9bea7252f1fa8fcf3950ae2bd404dcd189eeac27bcdc1cf529acd8ebde0bc5f457d023
- SSDEEP 3072:u2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXnI:PbJhs7QW69hd1MMdxPe9N9uA0hu9TBKI
- TLSH
  T1F5C33966B2E01198DBB581F6D9921706EB7074761B15A3DB2BB853B31B2B4C68F3C3D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral15 behavioral16
- Target
  Monotone/Commands/Hidden/UnbanComplete.vbs
- Size 49B
- SHA256 537f70f7b018610dfedd4bcecf041d845eab0c673e129185c2345eb68a95fe77
- MD5 4edf8ecaf575c93e307bdce09aa46e8c
- SHA1 76c189b32fd69a3694e1dd14776cee1c1cc6c483
- SHA512 ce5921344aadcc9fce5141d416ca92e5772c1c37a0e8724c09c6c2ac579528a21e5fc8659c91db68810763b403fd9760d75102f6c22db84f8f5fe13fefaf6f1a
- MD5 SHA1 SHA512
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17 behavioral18
- Target
  Monotone/Commands/Hidden/process.bat
- Size 1001B
- SHA256 ef702ce2f8fb1bc71fb60e8b95cb83cef4fa66aa96afd7ca4fd67c96530b6e53
- MD5 2d3f9b2d001abd6e58ac6f0e7337c619
- SHA1 7053a604a394f479b643783098adb056d69a404b
- SHA512 60d4a7e203e37194f4a78f1c581728197b3cd6581d70e185ba6d0d8206aca3a732319b28fef776028015615ebc0ab164a9c935081cd2496b866c63ad6358fccf
- TLSH
  T1C011584C13D648479499A012C8090986E7D83FB2637DF990D05934D1F71397EDBF7C15
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral19 behavioral20
- Target
  Monotone/Commands/Hidden/spoofer.sys
- Size 6KB
- SHA256 1992c044963f5c77aa7b5462e2bb69a37c66bc0e13032524fb1663c0314fd420
- MD5 96756deaff1b2667883d4a21e43f4f65
- SHA1 bce3d6fb9eec3f2d2695d96e61442a58039d594a
- SHA512 b6f472c8296bbef5da4baf638e98c2e0c42ba3fa783c69a6c0cc1e2f92f4c365d6d1c0bcf26e1644bacd4a001fd97c19b5fe2b616ba3c0982fc7edefcb59ef7f
- SSDEEP 96:eA/w8VE6wC4NrkXyhWZ2JMQ4LI5aUZ1ZM2a3:v/f/skjZAMTOA2a3
- TLSH
  T1FBD109FEA159D283E7AD447A965B5655F332B2D00B00834FE8F868996483FE3392C715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  Monotone/GetInput.exe
- Size 3KB
- SHA256 3f5c64717a0092ae214154a730e96e2e56921be2e3f1121a3e98b1ba84627665
- MD5 2ba62ae6f88b11d0e262af35d8db8ca9
- SHA1 69d4ccb476cfebdf572134fead42a12750580e4b
- SHA512 a984212245e401b68872623437a512898a00d71cca7d7b0aa6733663020cae92d50ce1ae3abafbd811542a77e72c8b6a5755492c07d6ddeb2642d908142c2ccb
- TLSH
  T134719637E7A08971CF046BB4124794A3E41A753022A74907B7E84FF97D329113FA6B2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  Monotone/Getlen.bat
- Size 1KB
- SHA256 83ce5342710a2f2e385a363402661e3426728dd6bcfe9d87e22f2fb858b07bde
- MD5 8c1812e76ba7bf09cb87384089a0ab7f
- SHA1 d3edf2ba081073139960a955e812e6bb7f63817b
- SHA512 618abe11f65fe95cdc1f1834bf24ddbbea789c971788af7d2248b880e53d11a3c4302bd8e3c3c36b934f5f7d975d1b142fae8fd23c9ed6cfa118c97e01f6fd14
- TLSH
  T14741339022E523A652A2882B7E4E52D4D74BD0A56B2CB39DB4F6404E030B5BC20F9DCE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  Monotone/Monotone.exe
- Size 160KB
- SHA256 0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992
- MD5 cd6cddac2686df01814705f21e6da343
- SHA1 f29ad4efdc160ffba5cb63e01349ec9b84123e30
- SHA512 a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4
- SSDEEP 3072:yuo1MlSEqhqJhJy0WTHW69B9VjMdxPedN9ug0/9TBfsdZK0:y5oaqJhJMHW69B9VjMdxPedN9ug0/9Tk
- TLSH
  T184F3389672A01189DAB181B6D592C776E6707C760714A3CB1BE45FB73B2B4CA8F3C390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral26 behavioral27
- Target
  Monotone/README.md
- Size 413B
- SHA256 4abfd24b7422ee66d5849fda386dfd1318db4615f9126899a27fdb5a4ffa3d0d
- MD5 699d03e1e8ed798aeb721e8fd561682b
- SHA1 b0682fcadec2a52af958c6445b9755622b5111d0
- SHA512 fd71ce13f0930115bd4c4577cd6618aa37645df1a8b10a47789adc9f663edc9c5cdf82e385cb760444808268163922df9e53af103f0971f23c608929cb6a08e0
- TLSH
  T198E05C6DA03808A679426D9A654A76AC9A46400F6D05837EF4798354203E5DA13C518E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Monotone/Volumeid64.exe
- Size 165KB
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- TLSH
  T1A8F34A5233E410F9E1F3AB7089B55515EB36BCA65B34C78E162041AD5E72BD0EE38B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Monotone/batbox.exe
- Size 1KB
- SHA256 9553bc17fa0fd08e026c1865812b3388e3d5495a5394bbf671e5a8f21c79989a
- MD5 cb4a44baa20ad26bf74615a7fc515a84
- SHA1 2581868c3d560e2b200d4f21d83271430167b377
- SHA512 d19e6d0ccd89e52efdd2363185564cf83fcf3a37b55659dd1fd8b6574cf45b6147989b2c7b1e8029ce8136aa7ff74900494c1a30bbb65b96d9880ab7f77b6140
- TLSH
  T15531141E089C95FDD53B4D305D9B8913875BD8700A9E7B438FB8815EA0B6170EF58349
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Discovers running processes

Executes a VBScript file via the Windows Script Host.

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32