General
- Target release-x64.exe
- Size 82.9MB
- Sample261003-sdqqjs1dlh
- SHA256 bc0902faae53fb60c9b512ed1028577b3bab494bf1f9f1d3edab99d7d52ade66
Malware Config
Targets
-
- Target release-x64.exe
- Size 82.9MB
- SHA256 bc0902faae53fb60c9b512ed1028577b3bab494bf1f9f1d3edab99d7d52ade66
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 82.6MB
- SHA256 65b85fd81102ea156da899194bf4c1d426141ec4a8bcbf5726f0decc74ff315f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
Score1/10 -
- Target icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
Score3/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
Score1/10 -
- Target resources.pak
- Size 5.0MB
- SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
Score3/10 -
- Target resources/app.asar
- Size 16.2MB
- SHA256 de9f41bd07d517a09b868f6cef40f6e8f7fd92cfc41cad6ee3dfa3ef4dd84f79
Score3/10 -
- Target resources/app.asar.unpacked/runtime154f.dat
- Size 124KB
- SHA256 359e36870a546559049072ded348c60fa27dc2436a3324b5345ed5b3cc8a7cc1
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target sec-poll.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Process Injection
1Process Hollowing
1Defense Evasion
Indirect Command Execution
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
3Process Injection
1Process Hollowing
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2System Time Discovery
1