c7cf94239bcfeb9203330debe7c68c8a02c07bb24df44dde8d69ace934c69b19

Sharing

Copy URL Twitter E-mail

General

Target
FrostyModManager.zip
Size 79.5MB
Sample260930-dynpcsdf79
SHA256 c7cf94239bcfeb9203330debe7c68c8a02c07bb24df44dde8d69ace934c69b19
MD5 9f6e81129791a2e1a5d49c7b597b052b
SHA1 5a260553b2d066514f96f6573cce788e04b629cb
SHA512 00637fc93d03d945db09e1c9146458af10a96fbaf525614819e4a8adaa5bce6815af1502a45f055a741588f778cf4161ff1ddb17e1a904b4f328046194ab33f4
SSDEEP 1572864:87+TmZpG0Ftxn8EKR74cChlKkGbdFulfRNyj783IRwfoMYq8:8rW0R8jR74Bh4bdek+IRwFi
TLSH
T134083304BA5D97DC242345B5AA1CBDDCB3ED22BE1608119C982F4BF25F196EF41A80F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  FrostyModManager/FrostyControls.dll
- Size 95KB
- SHA256 289d7daef10e616d1ab977bddc13440eb7126f90693b2b54c6237697e6e6f34e
- MD5 24f88cd4f78d7d53f6b5c79ba022f508
- SHA1 c93702d249e0a56cc0359f884371258eee54bac0
- SHA512 26691f4f14d67a5c3af053bbea54194d863e133a672901416252422c0eb9d461081539cb2234f7058efc658d73d44fbfa5c5dd1f2db45ff4b215eede9493cd77
- SSDEEP 1536:ToNHZpEoODK2AnR1JApIejVw58/+WZAloMgtBoMrkx0Mdh4WyUj:TOnh5EuWBrm2k+Md2w
- TLSH
  T1F9A36C47A7704E35C6AA8BF994B246687A32565463C2EF9238CE2C8D78C6383C1D53D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FrostyModManager/FrostyCore.dll
- Size 5.9MB
- SHA256 ffaf354582c6ccc3c8cfd6190f63e9916518e08479bdfdf583df8a2ec1e877f8
- MD5 c4f51635185fc5556e1a3006bf12e03c
- SHA1 3ee4c1079eb424c0076d17a7aaeda8ce068ce7e3
- SHA512 52bb1f17dc8e714c21ac53b217c3671092e0016502c48ff3977e19f05012763065afa6dd0e3b6392d07e7b5c39dd178d42faf94b2e9f4e26bc48e8401b876061
- SSDEEP 49152:WdqSc9vrWcL77N4j6rQ5Tw5IFSH3Yd5Tso2VBZzbrDHg4D9hkV/7NQzBbaQ3Jd55:WyW
- TLSH
  T165567CE577C285B9FB8F2339A281C941DA3511522CD21036398D9B4E7397A84BF2F74B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  FrostyModManager/FrostyHash.dll
- Size 112KB
- SHA256 0366df964fd3c8571e4242a1f10478dd694c31388b24b80a6a8e2190e31c4b88
- MD5 fd6be3a8838e2dc396ba891871f6c6d0
- SHA1 4a0dcf25c4f0e6d56e8eb49b196d77d2213a1810
- SHA512 2f7f26cefb0f7504b66aeb80a3bba4a46916e4a6aed53b273ed97c5ab3434cd3924bab50236e9288c2d15be4df7f7893ebc7c528efcd1cb5472046b4f9951781
- SSDEEP 768:Q2sWkDDm0JnESE0J3EC/JR3w4qsbEpxgS/OuQtultjZlyQCFpVCzPgahaK:Q2sNDDm0JnESb0CHsxdOuQAzoMz
- TLSH
  T1C5B34F0316EE7DDAE4BA52B53B7383C2C32CEE455B13D24F91D161408A3E28B39967C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FrostyModManager/FrostyModManager.exe
- Size 524KB
- SHA256 87e198ecd0dce9b18fd12b1c496b7ec5ace667ee0d339103b7f476b524dd6dd2
- MD5 043da151f072c8c99fb659f7cebf00aa
- SHA1 0926cbec499b942afb1103126c75d0cd3c62c675
- SHA512 74761a846be66b22b116d08334957fe0acac9b4bae369c88bd49936c83395056e3bc2a829ae2c84bd01c525ba524a031a00b57ac98c29d338f0ff17561b82dab
- SSDEEP 6144:pEWkGA2iQR4C0XYUsaH/zA/Nt5IS/V/2:ZtriQKBaaHU//5R/Y
- TLSH
  T146B4375ED638984AC4AA15FBB426A14106341F16C66DCA2E8BB5F89878F73C30703F1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  FrostyModManager/FrostyModSupport.dll
- Size 105KB
- SHA256 81c350fd7fc35919457f27818cc73d9c410f214c77ef64e1ddb83149edbdf672
- MD5 21ee390d60b9bd3343c45d1ab29638ef
- SHA1 15c893d345c6834f3ef6e718333d06c400285d2a
- SHA512 d318ec0d3eff0b68481d6f6817d3f1c5ca73eeee53704ae37f05221440fabcdfa1df06591c4bbb4ffe25c2f1be00197d2aeb4e1feb588b7cc7678a8f222e7b9a
- SSDEEP 3072:IDXr925d3SiKcqPYXXHq4LDpvGA9qE0yHRhraHMcOIP2BO0XRFRc+bADp:upuNSiKcqgXXK4LDpvGA
- TLSH
  T14CB30A1ED6A8DB15C8BF0F7BB0E002954732A217D316E7A84DCF65C50C667247F8A26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  FrostyModManager/FrostySdk.dll
- Size 2.7MB
- SHA256 66b9c3d3d51e6133bcd69706ab4c2eb89756c3b4c97a175fdfca9b26066c3008
- MD5 8c812f10a8aa49eaba38c16eb733509c
- SHA1 009e47458d982de659c1d007f47b93f05603955e
- SHA512 6690ad57297982a0f0b645d3d97aadafea991f2e19cbc75a913822df9af17a3343adf99e9d780abac0a6330ee9b96a1873eeabdd3f966a58fa64cbb21d17d960
- SSDEEP 49152:+8H2smwkxQ1fqDs/n31tP1Ah4jw8fOAXUR0EoEB8/mZKlytcUiKbOoBZyXmvtZ7:+MZJ1fqDmXoV4IeEBCtlyvpbhZPv
- TLSH
  T159D5230573FC8332EA2F8B71F09456898BF6E637656FE74E0C88A4F51C477682258687
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  FrostyModManager/Plugins/BiowareLocalizationPlugin.dll
- Size 142KB
- SHA256 fd8fd0ff0de28085df086246f84f7b0bdfc1184affede7c210aee25f1fc1618c
- MD5 c75d13aedfb922eab777b94d0ac60c2b
- SHA1 4c9e7fc730598a9bc08529898c606374f7e8196f
- SHA512 50bafc3572fb28fd9f5f468ceb42750457f9cdc734e44079784985ac833f26133fbc7e2513d7bba858b87c852a089d9f17bbdbc3387675a2761336c151eda02c
- SSDEEP 3072:5FAw9zr0lzm1NRl9y8hPBZQ4gvGiDOW0/KHGX2Osvkl:b9zrc+hTdgOiDOFp
- TLSH
  T137E35A1613FD0666D6BF2A7D24B0615447B6A256D632EF8C8C9C78ED4CA33428B23737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  FrostyModManager/Plugins/DifficultyWeaponTableDataPlugin.dll
- Size 17KB
- SHA256 10df2e748c873ce24ba3cdec6a79a899c3f31758976e221299a2123abcc4917a
- MD5 174bdb24c73f62b9aad0cc82aff33d9c
- SHA1 aa674eb613b862a376454b8ad3bac5ab06fc2a95
- SHA512 0b1ef10a432ef4a39a3d29065d893e0bd9ce267894ab3aab7a940ceec357389f95f4b58ad3a8a2682e033247deca186072694565986a199fd7d1b24b12a0783c
- SSDEEP 384:2ornvNm6882D0YtwPoWUa2jMCANf69HqS:2oGd+FO7AFS
- TLSH
  T15E721A05AB5C8631CDEF0FB124A98A9C637FD609DD91CF0F0DDCB19A5897A160712B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  FrostyModManager/Plugins/FsLocalizationPlugin.dll
- Size 35KB
- SHA256 34cf5ceb70fa5cf6ec3fb28cfa3c0025e1934822f9eb9906cde430db513d9e83
- MD5 9bcb884ea4a1e6df8246a693f0b5b86b
- SHA1 9dfa9a6009d51d45f4fdc54963c5bf611a5711e1
- SHA512 b5c44e791a53525eb28aa51f0e9e01412e12faae0520cb8b2e0af91d3aa71570a07a3122b7cd461eb6274f20fd0855613bc3288718d76829e4238f81e2af34ad
- SSDEEP 768:eTRx76SVQZWIAdXKg6p/yzS7lqnI3cz1ecWMm+:eFASK2Kh3iN
- TLSH
  T1EDF24905713D8723D9BF07B928A6A05087B9967ADA62C7CE6CCE74DDAC673010703797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  FrostyModManager/Plugins/MeshSetPlugin.dll
- Size 257KB
- SHA256 6421a8fd2848797fee28b59fa3c269215db79ab6cc01f548faa8b955af2fa28b
- MD5 a94ccaeb6199bdcde8164b361f98aa09
- SHA1 05fb445f7938879a2a81592ee2f6e94094115550
- SHA512 010639aaa9de973d57db16869cd7c6d627648d6f6434335d6445e29753f7200b05ffbd0d9600ad1db86a6f64d885a0eb51b0fd440f257e9794ffb556248f7a24
- SSDEEP 6144:PGxrN2mqMYS/Sqvvcd0g0VcpbvgQsEr2SPC4nK9O:PK2RrStvctocpbvgQJPC4ne
- TLSH
  T139445A2A26BD1278DA2F577FA460040886B9C107A5DFC74E7CCDE4DA3F62740DA06B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  FrostyModManager/Plugins/Swbf2MergerPlugin.dll
- Size 82KB
- SHA256 a935dc3b99576c0a70c69eefd8888065440982513dd09e439ca53fc14bd0b078
- MD5 0a21868b1f61d4832f007b1a7cfbc20e
- SHA1 7ad569aaee11b6aa1d06cfa83c753204967d050b
- SHA512 bcc7d11ed9f4d704f08574eff797722b2a76846db7c643a65131975c845ae0292e4c1d6ee8ac271ecbd43ead0d25294d57d4effae1a0cc012f97340dd22a9d7a
- SSDEEP 1536:64sqPeIV4fIdjMUDQJ/JMimXPYycfUo1sr/KRcf:64sqm7fIdjMRrDf71sw8
- TLSH
  T18383625C669E6B32C8BD0BFA58B9764A4734F103E593C24D4DD9D8C06B33A860B217E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  FrostyModManager/Prereqs/NET Framework 4.7.2.exe
- Size 1.4MB
- SHA256 4e49c56e4cf9df2e837a8a3010f5a8b4deb096429d56e7fd9ff70ab394663678
- MD5 c84209349f18afe5a41ce04e9ae8f487
- SHA1 cedbbf404b166a5e72d035760bcb0fa508e4f4cb
- SHA512 37006954e3afe07fb02d24894cc34794618b78c27a1b514818985b6cc1fa3e896ed99ba2e4aac3f6469d263819bd94ee70e7113946c51ba83c93b74826fc8fa8
- SSDEEP 24576:NGHL3siy9hlzSmtLvUDSRbm4Jah1rVxXmBz5px02ZJX7KnIOXL6LKoAoY4U0GXFy:yL3s7PmeTUDBzrVxofxTZJXOIO76LK/y
- TLSH
  T17065222676F0C073D4F311718BE0E6F26976B2351334C44BBB58A72D2FA43946ABA356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  FrostyModManager/Prereqs/Visual C++ Redistributable for Visual Studio 2015.exe
- Size 13.9MB
- SHA256 5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3
- MD5 27b141aacc2777a82bb3fa9f6e5e5c1c
- SHA1 3155cb0f146b927fcc30647c1a904cd162548c8c
- SHA512 7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011
- SSDEEP 393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
- TLSH
  T131E63332E6644227C6D30973ED65E2246EBCA22D7F108476C784AE1DBDAC4D393B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  FrostyModManager/Prereqs/Visual C++ Redistributable for Visual Studio 2017.exe
- Size 14.6MB
- SHA256 b192e143d55257a0a2f76be42e44ff8ee14014f3b1b196c6e59829b6b3ec453c
- MD5 0af5748a2e790472af28e64105760eb7
- SHA1 7ecf5797bc24eded2454aae6f3ca95c4f6eab807
- SHA512 9c3f6195477f836cdc948cfdb52f8e14b9b7ff9b59d036f6fe281d01d1cfcff53a7bed1c861f8e142a0060c5b8ee14d6df647f3de2181ac309da2863a21b92ce
- SSDEEP 393216:lLlptVYmfr7yBG/4VgXR7hg7omRRjMW8Y6PJUA+bTqfQ89:lxpttD7yBG/zRKoOjvSUA+vqY89
- TLSH
  T1CDF6333296594036EBE30033AA58F9343F7DA52823158AFBE3DCED2D297809227F7555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral27 behavioral28
- Target
  FrostyModManager/Profiles/AnthemSDK.dll
- Size 11.6MB
- SHA256 69655c34d8112b6e5951bf7f108a42b84ec4dd39d3889435fe3ade7a38ebdf9c
- MD5 9c009ff799df68e027ad91e02ed0b3da
- SHA1 c6e1ba7f1c60b5e79671245b50275d941179f21f
- SHA512 4be1af14d9e24b5c086662a0a85813020e607f5ea476aec6572dbc4df6277d438e2f3bd73123cc2c2f88896b355972586b9420b31ef878293ce6350a6d7e3047
- SSDEEP 98304:MW6Awh/bYCKxVKC/NBcw0rSC/Ns2B7PxQpAbtBcrlC:K+KC/NBcw0/s48rl
- TLSH
  T1DFC6E6816B26C62EC85D5830D4230A7A83B1C74F7F6FF6B64748D4BE394BB20DD62166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  FrostyModManager/Profiles/BF1SDK.dll
- Size 5.0MB
- SHA256 e14254dd1a8e39aba9c4ae1022fd5a5ec817370daf57249daac5bb818f025f1a
- MD5 865199fd0f2341285d23e09d8add5c8d
- SHA1 538328ab90487922d06be80ae12aa8f9844207b0
- SHA512 5bf67c34e7ef9d4930a65c68835d39ea4713be78a4fe7315069adc1cd9e13fd7fa08269314e2e43535099ec653d2a92d0acbbbe180b2cf6e30fcaac5f2d22273
- SSDEEP 49152:dGk/IOeK5gBr5evQ8hbVJSr4SQzKlfFTB+Im0SLAYrTf1Bzail6kA5Pjh:QcPRvThbVJS0SQzE9TB+a
- TLSH
  T16736B4019A55CB9FC5969472F022613663F1C3597672E7B12F98E83EBD07B099E032B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32