fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6

Sharing

Copy URL Twitter E-mail

General

Target
XMT2_Win_Setup_20.7.28.exe
Size 91.3MB
Sample261024-ymst6abz4y
SHA256 fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6
MD5 9a65af3199c6a9fc3820e7ec7c738e53
SHA1 89368559de13cef61ebaea881b7385eaf9107932
SHA512 196015c9852f9e65da18bb6119971e637b8e1490661102f6616e6352f63409c9ef36f3035d8128813ba5eace88cf8c6d2f2f1c33a9c5a6e6022d7b6fcb6a3b40
SSDEEP 1572864:xdEEo7QJ1cOW0IBV5CUX5Njm2gjvY2hhI+/1qE/wedzDZ6:xeH7QJ1wjI65BRqYQ+u7/wedzDZ6
TLSH
T19728337714435876D91422BECDEB15E30117EE845F7D92431A42FCDA38B688F0ABBAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Targets

- Target
  XMT2_Win_Setup_20.7.28.exe
- Size 91.3MB
- SHA256 fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6
- MD5 9a65af3199c6a9fc3820e7ec7c738e53
- SHA1 89368559de13cef61ebaea881b7385eaf9107932
- SHA512 196015c9852f9e65da18bb6119971e637b8e1490661102f6616e6352f63409c9ef36f3035d8128813ba5eace88cf8c6d2f2f1c33a9c5a6e6022d7b6fcb6a3b40
- SSDEEP 1572864:xdEEo7QJ1cOW0IBV5CUX5Njm2gjvY2hhI+/1qE/wedzDZ6:xeH7QJ1wjI65BRqYQ+u7/wedzDZ6
- TLSH
  T19728337714435876D91422BECDEB15E30117EE845F7D92431A42FCDA38B688F0ABBAC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
- MD5 8d5a5529462a9ba1ac068ee0502578c7
- SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
- SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
- SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
- TLSH
  T134622A55738488F3DBE2003E785237079B995565B492AED2CE275FCA687B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  XiaoMiTool.exe
- Size 134KB
- SHA256 b5692982e55fac4cfc34bdd09516ef7f243a4f2196ffb4722ddf56c8740e52c0
- MD5 b10c980c000c540b24229f33ce0007c8
- SHA1 03f1156f1a4fd313f2f2677a58e62bd0d4c63f87
- SHA512 990529a74ea731c62414652b4beeb0c06be0eb4dc80faf8f151c8aa05bab5319734d7e58efd03e7bdbce938845378ed61fed498cd8b46a19775ae8bb89e04864
- SSDEEP 768:BP7N3qgq0mNw2UiCp0MkfKAqQnGrW3M7RH9fN0nPCQLWVE:BI70miqCyJq+3eRVHOs
- TLSH
  T1C9D31803B50580F0E9170130C2CAEAFA9B23DF27AF36455BDB657D5BF93718A291B642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  XiaoMiTool.jar
- Size 10.4MB
- SHA256 a8ba4ab3bcae906f953f4441d637e90509895a75a67733d48d5845bc4c9f8faf
- MD5 53832e28c7dd790766991c6fd037833b
- SHA1 15c482711dcfa937cb2852b00cbccff1b4e42f07
- SHA512 b6c22fb102a8c2cd8532db4e5653ab99271066e1da0db773dc8343b83e495a9ba4e4239852c39dc6cbd908718d22f3841e5183793d4b0604b265d01d67c09172
- SSDEEP 196608:QcN46aOWU+VfbRYB+6eSYLJUlFCov/vg2CIBDx9BgBXmiT7:ZNpnohbiBZDOovwvIt9gBXm67
- TLSH
  T100B61212F68860FDF583403364125C677A794990E24B909D14FC6A6F998BC4E3F3AB7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  bin/api-ms-win-core-console-l1-1-0.dll
- Size 20KB
- SHA256 89384f8f64a9b7f67c8deccaa721e2d76b8a17026d8083630859ed0cd1a9b58b
- MD5 2c146bc8d73b8944f35506241b9953a9
- SHA1 ac64abd745418cea35c0506b9cb0331b171b51ea
- SHA512 02713948a156baccb2e7c38646193e82fef65400c086644866b698bc3e0a8c155a8eab829463e3868ce2b8a06608c5ea6de1e390bff976c5f92e2e42dd6c04f1
- SSDEEP 384:WyWfhWoLm0Gf21MgKlx+YEL1MgKlx+YybT:AVRig8Xg8yf
- TLSH
  T151923AC38EBC9443EE976DB017A8D9837C3C9BC72910916515BAF5A91CC37D6EB0462C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  bin/api-ms-win-core-console-l1-2-0.dll
- Size 20KB
- SHA256 f901b0bc8c00b3afc80e151e6f54b18f7672f932602c304fbfeedd5aa3ad63c8
- MD5 7a55e51d07e1f15221eb11479adbc53f
- SHA1 8d8e2beff4dfa78372201b26a67b9dc4b116290f
- SHA512 e89c0e45014abdaf7548de0352949c4ad496d97cad2f9e2f6c83a90f853b7b71354b9abbb957eff89076df79bdc9cc1c431b6f35875550bfb4198c3a68124197
- SSDEEP 384:WiWfhWcLm0Gf0WsXqldlx9yN9jBscRqldlx9yN9i:I9RNFhXA
- TLSH
  T17B922BD38ABC9143EE93BD7017A8E5837C3C67D72910909125AAF9ED2CD37D29B1492C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  bin/api-ms-win-core-datetime-l1-1-0.dll
- Size 20KB
- SHA256 12d801992bbb09d43bb90330bb96e77bf12e669c325dda4b5235942221c301c8
- MD5 f0c9c56f56ffa3adc548173569dbd793
- SHA1 220a56b84cdb8cd403483d3f6b4bb526fe198fd9
- SHA512 28e24a2ccedfaf01aef615c1df7f8c76ff0eb06d992eb1b422f902d6d96357ba6a353e31ca9b1fd305e7de7a437ee6a7f2f01bfdf27c4a88c805693ae2b6352c
- SSDEEP 384:W1WfhWFLm0GfYKllGBwLeqvYqldlx9yNZ7:FsREL7gl
- TLSH
  T1F5922BD29ABC8443EE93BD7013A8E9837D3C67D72A10916605BAF5ED1C837C2DB1452D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  bin/api-ms-win-core-debug-l1-1-0.dll
- Size 20KB
- SHA256 64a9ac181fd91b79270bf01759749394f57be171436ed46f43d165325bb82067
- MD5 02d669afdabfe420598041b848b71158
- SHA1 25c0fdbc04ffcd570db041d02842d7530afeeb6e
- SHA512 5321290ec277fca8840e6c9cb7e77d39e820b1d98ef9c29040efaf2a7628c023209c936e08abfb6962a795130874544db25e1bac0d16256a1ebbca0fdcdaa81a
- SSDEEP 192:W9WfhWaf40V2sms/nGfeMiQd8fZvqnaj9WWPMFwJEfFF/WWFYg7VWQ4CWWPu2uo5:W9WfhW2Lm0Gf38xlZWWkiJEB+2ZlxrXr
- TLSH
  T1BC921AD2CBBC9443EA937E7013A4D9837C3CA7C72D10916505AAF4E91CD37D6AB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  bin/api-ms-win-core-errorhandling-l1-1-0.dll
- Size 20KB
- SHA256 44822ae123a3d6c3a8bdf9a4d65a4dc89eb31004c72fcfcefa1dc3a53ff3eab0
- MD5 944a33d971704ff815a6c90733d0a72e
- SHA1 7d8b9f68a3983a1b86bf4bae085cd5ca6f464921
- SHA512 4d93dece856a24e50f12a53155e07f1aab501b17e7bbfcce205e1b37d2799caf3681b1770c522ba986ac3badba59d5d95a7526fe19f86a7b0d3d933ea73754e2
- SSDEEP 384:WeAbDWfhW7Lm0Gfr1MgKlx+Yz2OwkZJl0huSwpvPr:DAbgiRRg85wkWhepvPr
- TLSH
  T178921AD29ABC9443FE937DB023A8D983BC3CA7C71D10819505A9F5E92C937D2EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  bin/api-ms-win-core-file-l1-1-0.dll
- Size 23KB
- SHA256 c15dacec228f40ce4c5b9d69bba5e6627bc484c6e9d6550a76db6f332e9f7734
- MD5 fec01082bccddadad0814f30b43ab078
- SHA1 a6f6d9b61bb743651d3f65824d06427ca492c120
- SHA512 c6039c366cb47ca31c7501423384afc0678a07abeb0ca1d97ecb5aa3c3e3acf84c9551dea1e56d1dbd4472dab70eed1c79d1c0612ba2730327ce6d0dc151c441
- SSDEEP 384:WmBPvVXuWfhW7Lm0GfQ2zlxCHLXYEv0l9K8e:7PvVXvGRtLl
- TLSH
  T112B22BD3D9B8E143ED8FAD7112A1D9437C3C93C7082540951AA9E6AD2CD73C2E74896D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  bin/api-ms-win-core-file-l1-2-0.dll
- Size 20KB
- SHA256 27878021c6d48fb669f1822821b5934f5a2904740bebb340b6849e7635490cb7
- MD5 b5060343583e6be3b3de33ccd40398e0
- SHA1 5b33b8db5d6cfb0e8a5bb7f209df2c6191b02edb
- SHA512 86610edc05aa1b756c87160f9eefe9365e3f712c5bed18c8feca3cae12aef07ccc44c45c4be19dc8f9d337a6f6709b260c89019a5efcfe9fa0847d85ab64d282
- SSDEEP 384:W7WfhWnLm0Gf0Kuh1MgKlx+YTVtZKllGBwLx:3yRREg8JtcLx
- TLSH
  T1AD9209D29A7C8443EA937D7017A8DA837C3C97DB2A1081A505BAF5ED1C837C6EF1462D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  bin/api-ms-win-core-file-l2-1-0.dll
- Size 20KB
- SHA256 c55eb043454ac2d460f86ea26f934ecb16bdb1d05294c168193a05090bf1c56c
- MD5 2e8995e2320e313545c3ddb5c71dc232
- SHA1 45d079a704bec060a15f8eba3eab22ac5cf756c6
- SHA512 19adcc5dd98f30b4eebefe344e1939c93c284c802043ea3ac22654cf2e23692f868a00a482c9be1b1e88089a5031fa81a3f1165175224309828bd28ee12f2d49
- SSDEEP 384:WnVzWfhWSLm0GfHJl0huSwJU5YiKllGBwLbyr:CVQnRHheJUadLbyr
- TLSH
  T1C99209D29ABC9443FA937DB013A8DA837C3CA7C71A10816505AAF5D92CD37C2EB1496D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  bin/api-ms-win-core-handle-l1-1-0.dll
- Size 20KB
- SHA256 6dcbdab7fa8cf66f4a05d1f5166bed33cd88bee1d37af6128f18184e6c301709
- MD5 31ffff2c6539b3d2f575500300b93d6b
- SHA1 e28e8919150fca0cb385f55a4ec4d23058d92fbf
- SHA512 716f42f0dc530774665982f189a1fbf0371aceb4087de67e5b677cb18a687900c73165a57ae8229b53744e2490d4f04a54686e09da3b5d8705e1df5b804fe27d
- SSDEEP 384:WIWfhWgLm0GfE8xlZWWkiJzebPqldlx9yNVLzX:OxRviWhX
- TLSH
  T16D922BD2CABC8043EE937D7017A4EA837D3CA7C7291091A505AAF5ED1CD37D6AB1062D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  bin/api-ms-win-core-heap-l1-1-0.dll
- Size 20KB
- SHA256 2e00c0176952d7c009b93c40949f91f0ab367a1b274ee78b736bf563f0344da3
- MD5 c7120579bb8f56f8cd4e0d329ece3e9d
- SHA1 0b35862dcc9654fc4ede338c26d0368c112d4ba9
- SHA512 6172179c349f9952e6fb47a72a459ee29563a511d9da2a16a265625f1d8ca40ff9bd52f78a26d29b5297e7413bfa22a9797df2934a68ea551d0ab45914ee7822
- SSDEEP 384:WMlKWfhWGLm0Gfomv0l9K8hHTRQg6gl9iI:zLRftuU
- TLSH
  T1A6924AC6CABC9043EA977D7023A8D9837C3CA7C72C20816515AAF5992CD37D2DB2563D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  bin/api-ms-win-core-interlocked-l1-1-0.dll
- Size 20KB
- SHA256 d4d86e560a22d833fcdf0ba165d3bd3f6059e69830f4d2f9748af08905b2d4c8
- MD5 1144ced0d8198c39f62fc71c1ecf6cb1
- SHA1 43ca991199a46ca1860f8a295209dee6d32d040d
- SHA512 006b420d4513fd2be1e07f7512891275cb76243fd4d49855836da53ff779fa695b9bd5661fa16b1c8f83d8cec6342c9719def8d3242431b13e803bdbc2d81e4b
- SSDEEP 192:W/WfhWfv40V2sms/nGfecTTCeJgLIyqnajV4hhZ7si8WWFYg7VWQ4mWwsMbus/qm:W/WfhWtLm0Gf3CeAplx4bZxcyv0l9K8
- TLSH
  T16D923CD28ABC9083EAA37D7017A4D9877C3CA7C71D20816505AAF5E91CC77D2EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  bin/api-ms-win-core-libraryloader-l1-1-0.dll
- Size 21KB
- SHA256 655bade7ff61f01a803e7532082b14ae354442b0f65ef8164f824d0cfa033e6f
- MD5 2acf6db396a86e2bef9d6ddf6919581f
- SHA1 c67615b97b74776fa64407e7644f92cd14336cbb
- SHA512 9a804bad2a9f220281cd3c20dbc96c023819da96cd24341c597a9d076b5fd176ec9da8e6a227628156827294cfb460e78d41eb053e133b1038a305c996453a36
- SSDEEP 384:W7vuBL3BrWfhW5Lm0GfwMs2ZlxrXwulS+Jl0huSwpMu:ZBL3BIsRT8uhepMu
- TLSH
  T1F8A219D2CABC9183EAD36D7053A4DA837C3CA3C7592080A505ADE5DA2CD37D2EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  bin/api-ms-win-core-localization-l1-2-0.dll
- Size 22KB
- SHA256 646b28a20208be68439d73efa21be59e12ed0a5fe9e63e5d3057ca7b84bc6641
- MD5 54d2f426bc91ecf321908d133b069b20
- SHA1 78892ea2873091f016daa87d2c0070b6c917131f
- SHA512 6b1b095d5e3cc3d5909ebda4846568234b9bc43784919731dd906b6fa62aa1fdf723ac0d18bca75d74616e2c54c82d1402cc8529d75cb1d7744f91622ac4ec06
- SSDEEP 384:WXOMw3zdp3bwjGjue9/0jCRrndbWsWfhWkLm0Gf7t6gl9i7uBJl0huSwprv/N:6OMwBprwjGjue9/0jCRrndbGVRdGOheT
- TLSH
  T121A229D2D6B8D143F94EBC71226AD5437C3CA3CA1821859102FAFA992CE37D6E71463D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  bin/api-ms-win-core-memory-l1-1-0.dll
- Size 20KB
- SHA256 13ae84007249d532f326a00ad62e5c1f463581f30701e662bb1b3658c4c32a07
- MD5 e7b662ffa023b7f07a85ac3fb8910c11
- SHA1 261edc0c4068771f0d070c17e0721d8a1bfcaf9f
- SHA512 8df890a9aa191b594bbc033bc384deb27f9e4110e51632f681b33061b4370cec6ff2d637b20a38fc882ddc74dd8247f177cea2b05a13655e7b49e07bc280d756
- SSDEEP 192:WJqWfhWN940V2sms/nGfesTvMbus/qnajBMh8PAU8QWWFYg7VWQ4SWbSeJgLIyqE:WJqWfhWtLm0GfDv0l9K8oWXeAplx4bZw
- TLSH
  T122922AC69ABC9443EA937D7017A8DA83BD3DA3C72C10816505BAF5961CD33D2EB1493E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  bin/api-ms-win-core-namedpipe-l1-1-0.dll
- Size 20KB
- SHA256 84cec1a1aaf344a93581b0f0c293623cd07652982a9f54f2fc879092512c4d92
- MD5 da29d8d5a978e12d07f930f402e14180
- SHA1 568943dedabc74749db557cbb398b9d72d57501a
- SHA512 da65f9490f46b2509c4e15a82879ce64baa947fc978f20e052fb9bb9d002bb9c21a5b847d1d6258a4fa5747fcd22542f246b14653f5a67c528d60f919ede70c5
- SSDEEP 192:W/WfhWNs40V2sms/nGfesdIeMbus/qnajBMh8XXWWFYg7VWQ4SWZCAzNXO0vqnaS:W/WfhWgLm0Gfuev0l9K8X1ZY1lxd3EQO
- TLSH
  T12A9219D296BC9043EE977DB013E4DA837C3CA7C72910816515AAF8E91CD37D1AB2463D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  bin/api-ms-win-core-processenvironment-l1-1-0.dll
- Size 21KB
- SHA256 c6e8472ffc639ccd9c07e7f6954da9ae94779cb9a81acb11ed3588cdca1182b0
- MD5 d67863ab55ef2a9d195870c360ceaeb4
- SHA1 b0a604463be51ef269f203e3a3be25b1d874ed05
- SHA512 b12fd7f7e9767f824810d2b3ed1fc3cb8d222c95a3894adaaed7e48cc9d690333e68665c622f0b9f3775b0a8b3e043b1e97b6987abb1ae68b94dda60d83371a2
- SSDEEP 384:WPWWfhWJLm0GfTJl0huSwJ4w7ixH2zlxCHJV:owR5heJ4w7iF3
- TLSH
  T10AA22BD29ABCD043FA977D7013A8E5977C3CA3D71D108065056AF6AA2CD33D2E714A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  bin/api-ms-win-core-processthreads-l1-1-0.dll
- Size 22KB
- SHA256 a1a413de3c85658d1672aa4c6aa77056e1a4884ab9ed5bb572cad991c9b348db
- MD5 d5fc4afae80dc3abf97b716416bc2952
- SHA1 cd0fd43345393b633c315b489ee85fd846597ce6
- SHA512 d5fe2058bf212136248afe0675477ec03defab7db7e08667f9cf1fd9c1fb87d639a3af049639f7d1bfa136728d3ea420d85bcd20f8f3a39dda95cf69098d0bf2
- SSDEEP 384:WsVWXk1JzNcKSIHWfhWoLm0GfA5KllGBwLcISODJl0huSwpFe8al:DVbcKSt5RF8LvSOkhepFrk
- TLSH
  T179A219D6C9BC8183F9866D7123A8E9937C3DD3CA1E25416105A9F1E92DE73C2E72853C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  bin/api-ms-win-core-processthreads-l1-1-1.dll
- Size 20KB
- SHA256 51a73fbfa2afe5e45962031618ec347aaa0857b11f3cf273f4c218354bfe70cb
- MD5 d1b3cc23127884d9eff1940f5b98e7aa
- SHA1 d1b108e9fce8fba1c648afaad458050165502878
- SHA512 ee5e0d546190e8ba9884ab887d11bb18fc71d3878983b544cd9ab80b6dd18ad65e66fe49fe0f4b92cbc51992fb1c39de091cf789159625341a03f4911b968fa2
- SSDEEP 384:W0t9DfIe9jWfhW8Lm0GfMjqldlx9yNTVvgwr92ZlxrX:fwe9AtRhZ9VU
- TLSH
  T123922BD2C6BC9043EA977D7013A8E9837C3DA7C7292181A505BAF5E92CC33D1EB1552D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  bin/api-ms-win-core-profile-l1-1-0.dll
- Size 19KB
- SHA256 9518b9399ac4d459122e428173b2baaccd92c02e585a13e58a7812fad7012381
- MD5 2e19bdbf51d8caf97b2bcb886fdc5b2d
- SHA1 5277e6a9660606d58a116776fbabd92fc4cdb417
- SHA512 0af6a11e4704a7251ca9b3ebe1269b24aff6620545895f33a60e04f8587738a02919f7e4d1fccb9a59a0a697560c8bf0ad64a3cff99ce7da4ca972bb3e704367
- SSDEEP 384:W/IWfhWbLm0GfL71MgKlx+YvclPNqldlx9yNF:ymRtg8kt
- TLSH
  T131922BC2CABC9043EE937D7057A8E9437C3CA7D7292481A505BAF4E91CC37D6AB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  bin/api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 20KB
- SHA256 197a57651e3014f9f3cf21fbcaa718de63f0a76f222a3ad08f287bfedc101bfa
- MD5 e8789ec050c879b856f1f13b9cee6f3a
- SHA1 8264646f975c87e89803fa62d5ceeb0100f38214
- SHA512 417785e476ea1a8ae88dc872683f4e5ef12695f4e74ec68f3921d89142cd443dba2e2c1d37f54c8eaa9c8ddaf14cdcf7502139a6c28a55502e242cde438d10f8
- SSDEEP 384:WUGeVxWfhWULm0GfS/eAplx4bZl9Dl2ZlxrXwJn:xGeVmZRZaqa
- TLSH
  T138922BD2DABC8043EA937E7017A8DA877C3DA7C72960916504AAF5E91CC37C1EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  bin/api-ms-win-core-string-l1-1-0.dll
- Size 20KB
- SHA256 3c2c4d10c8397a38d6a1407c4606907df5781b1339893c3861605094d8a69053
- MD5 a92e0c30499a3be2b4166adafd86d0f4
- SHA1 cb1293dc3ff5002b4950233cbc3bfa3a12249bdd
- SHA512 70ed8bd03d3aecc5d2967d87dca376fdc69232422cb590a673eaf6721d2793ec2ad5d46884740a6d9f961b72f71e94ce322d773bc5db2807cc2708d35e0f48bd
- SSDEEP 384:WPyMv9WfhWNLm0GfZ1MgKlx+YFPeAplx4bZUYV:4yMvagRZg81aTV
- TLSH
  T1E6923BD29ABC9043EAA37D7017A8E9837C3CA7C7292481A5057AF5E91CC37D1EB1462D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  bin/api-ms-win-core-synch-l1-1-0.dll
- Size 22KB
- SHA256 bf32d8aea6faebe41b1454e4b80b5a3639ba2cd35a9715de25acd7f28bf6d4de
- MD5 393ced54d952c843ac9e16354bff642b
- SHA1 407fe145c0068150827d95544f8344a24eeaf589
- SHA512 b296ff475ad0bdb8419b7535ce8ee0e1b20382f477a87ed57b257ed382755b6e9a5578697623a4cbadc32ff601e6b45f0e581869f2c45926cbbeda97fd6265b6
- SSDEEP 384:W2dv3V0dfpkXc0vVaCWfhWcLm0Gf2GC6gl9iVYiNeAplx4bZVwY:vdv3VqpkXc0vVabZRwThdaft
- TLSH
  T1DBA22A92D6F8E483EA5BAD7007E9D5837C3C57C71D20807205AAF9992DE33D1EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  bin/api-ms-win-core-synch-l1-2-0.dll
- Size 20KB
- SHA256 80fbae0acceb55364437bdd862d454db5acaa797ad0367931aef7677c7e84e7b
- MD5 dac3e271ef4a287821becda51aa12946
- SHA1 a8d1211d4881e1ff1b948b5139fbaf2af5028e5c
- SHA512 c7664a12eaee82127cff203c79f16c87b9388e57adba7cdfe3b86f4b92aab198127658bf83f4b15c14f661b1c1e1aaa6a2195f036bbad3cb72229e7ae83bb435
- SSDEEP 384:WQtZ36WfhWlLm0Gfo6gl9is+9mJl0huSwp8S:JUR4g+3hep8S
- TLSH
  T17D922AD69BBC9543FA97BD7017A8D5837C3C97C61920806114AEF1AA2CE37D2E70492E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  bin/api-ms-win-core-sysinfo-l1-1-0.dll
- Size 21KB
- SHA256 96a594b5a57303ae1e1dce14724a46500edc38d2c5cca0f52f0c77e3ebc916b1
- MD5 eb3aeb684858b00bc6a90f68e8df5484
- SHA1 f0a4298880ad6d7b1b92a289fd05fe352b3bca3b
- SHA512 57ceea716c30d5ecc718114d5f4ad67f28acb949b9c537c78a000186dbd7e217f2fab0a4ac24df9e407b6260286a93161353fd82ade23c0280e825f91ff7690a
- SSDEEP 384:WQTnWfhWwLm0Gf1XWv0l9K8rZTj6Jl0huSwpaO:RTshRKXpj1hepaO
- TLSH
  T145A22AD29ABC9043EA937E7013E8DA837D3CA3C71D11815905AAF2A92DD37C6EB1453D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32