General
- Target LuaTools-win-Setup.exe
- Size 11.3MB
- Sample261018-qh5ddsbb42
- SHA256 bae35a2c7fb871adf5aec2a4f8bade951533a1fb8672b273986d57cddf58ee8f
Score
8/10
Malware Config
Targets
-
- Target LuaTools-win-Setup.exe
- Size 11.3MB
- SHA256 bae35a2c7fb871adf5aec2a4f8bade951533a1fb8672b273986d57cddf58ee8f
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Probable phishing domain
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Defense Evasion
Debugger Evasion
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Debugger Evasion
1Peripheral Device Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1