Overview

overview

8

Static

static

3

pulse-installer.exe

windows10-2004-x64

8

pulse-installer.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

THIRD_PARTY_FULL.html

windows10-2004-x64

3

THIRD_PARTY_FULL.html

windows11-ltsc_2024-x64

3

amd-lever-probe.exe

windows10-2004-x64

1

amd-lever-probe.exe

windows11-ltsc_2024-x64

1

app-knowle...rt.exe

windows10-2004-x64

6

app-knowle...rt.exe

windows11-ltsc_2024-x64

6

pulse-elev...er.exe

windows10-2004-x64

1

pulse-elev...er.exe

windows11-ltsc_2024-x64

1

pulse-watchdog.exe

windows10-2004-x64

5

pulse-watchdog.exe

windows11-ltsc_2024-x64

5

pulse.exe

windows10-2004-x64

6

pulse.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    pulse-installer.exe
  • Size 13.9MB
  • Sample261011-pgvxwsas5m
  • SHA256 66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target
      pulse-installer.exe
    • Size 13.9MB
    • SHA256 66cfbb0aaf99a4856547cca14d817bedf2ae48f6d3ece72dde556f89c0cebb19
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 15KB
    • SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsis_tauri_utils.dll
    • Size 33KB
    • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      THIRD_PARTY_FULL.html
    • Size 346KB
    • SHA256 fdcde38c08b4f4493ca9da7f161d022b78ddbc8032282e1247299fe5ac961f31
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      amd-lever-probe.exe
    • Size 447KB
    • SHA256 156a1fc594d0d401b06924a419ff0e0eb914cd7e3f0196ba994154d780bcbe00
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      app-knowledge-export.exe
    • Size 5.4MB
    • SHA256 093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies boot configuration data using bcdedit

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral21behavioral22
    • Target
      pulse-elevated-helper.exe
    • Size 451KB
    • SHA256 89ef9b93167fbf96ca0f03c0fc0175b3498d2475e37c5a996d1c9b53eaca3915
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      pulse-watchdog.exe
    • Size 442KB
    • SHA256 ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discovery

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral25behavioral26
    • Target
      pulse.exe
    • Size 40.1MB
    • SHA256 a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutionpersistencetrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral27behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

2
T1059.001

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Power Settings

1
T1653

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionpersistence
Score
8/10

behavioral2

defense_evasiondiscoveryexecutionpersistence
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
6/10

behavioral22

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation
Score
6/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

discovery
Score
5/10

behavioral26

discovery
Score
5/10

behavioral27

defense_evasiondiscoveryexecutionpersistencetrojan
Score
6/10

behavioral28

defense_evasiondiscoveryexecutionpersistencetrojan
Score
6/10