5ec8dab85ad20c8059d77d49bdcea8ebf20bfdf5115c849a83810ad959bb0469

Sharing

Copy URL Twitter E-mail

General

Target
Watchy-1.2.3-windows-x64-setup (1).exe
Size 107.3MB
Sample261026-yah47af17y
SHA256 5ec8dab85ad20c8059d77d49bdcea8ebf20bfdf5115c849a83810ad959bb0469
MD5 ec91528ca0830af4c4c1da17cebb2f2b
SHA1 e46853fd99d1e98c6dbf4393242e24cd19aee861
SHA512 98ac2e0dc98d3514db50319bdfdffd4fda943a8c1553bdb6b4127e828079af20e60481cff54bc844549cab2f3fafc561ce7edf8eb9e1b3376389406409646b16
SSDEEP 3145728:tX1mhEGIRU1hY1eHCfqreC/dyeehwsGgRW:Wm+hjifQDPO1RW
TLSH
T1C63833C7FEF68927EBD6E533810AC006552BECAC8A335CB97BBEB1614234585E45DC09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  Watchy-1.2.3-windows-x64-setup (1).exe
- Size 107.3MB
- SHA256 5ec8dab85ad20c8059d77d49bdcea8ebf20bfdf5115c849a83810ad959bb0469
- MD5 ec91528ca0830af4c4c1da17cebb2f2b
- SHA1 e46853fd99d1e98c6dbf4393242e24cd19aee861
- SHA512 98ac2e0dc98d3514db50319bdfdffd4fda943a8c1553bdb6b4127e828079af20e60481cff54bc844549cab2f3fafc561ce7edf8eb9e1b3376389406409646b16
- SSDEEP 3145728:tX1mhEGIRU1hY1eHCfqreC/dyeehwsGgRW:Wm+hjifQDPO1RW
- TLSH
  T1C63833C7FEF68927EBD6E533810AC006552BECAC8A335CB97BBEB1614234585E45DC09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 5.4MB
- SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
- MD5 3f5d5669497c9d912e5f0412611f992c
- SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
- SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
- SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
- TLSH
  T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Uninstall.exe
- Size 223KB
- SHA256 3760ba63a77188684225e0aac84b0f009753c51621f6673e23733abc07f6f974
- MD5 57852c7829a912c2aa72b1b9497e5e7c
- SHA1 9167ef92ad389a8ec213112d1d49a7d01b3f30f7
- SHA512 aeaee3d99b511c3a81c20287ddf9081579556304dca6f4ee9f4a02f041cda81a00ca5ce3dff09de33975a32dcfd7b926d943521e23a44d49f97a0920184157b3
- SSDEEP 1536:1q3SLmuM3hm0B0Bcbk7G8YTXj0cSheEqqqqvqqqqqqQqqqqq7qqqqWqqqsqqqqqu:YCKuIhmkaYTz0cSheW3QvxB
- TLSH
  T1DB24FDE4F3F71D6BEFE3E435521A9292B832BC3595739CB522BFF188A03D6515A0A401
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
behavioral10 behavioral9
- Target
  Watchy.exe
- Size 238.4MB
- SHA256 0fa2ce09371f45c2248b4c30875ee11f484a515624215e900dc621b12634efcd
- MD5 e26aff5d80d01ccac6e6249e11705201
- SHA1 b324211f92a57483103d18e7e3795dfabd83b02d
- SHA512 b16420df3f2664bb0f8b3272a098907d01dbdd8abf43fa0d12735fc3d258c357d6e8aec073d9ea2d65edccc72a3c52914c3996e42453690c24e9c0d6d8a924d5
- SSDEEP 1572864:2I3/VR82wZHoiobXsmAcfxy1eLk3f72msgaA4tpSariWp6LtcbvtGGwGbE8Stjwa:7n8GtfBxvs13c8IS
- TLSH
  T1A2C88C03F29A01E9C05DC1B9975A9633FEB1B8454B24A7CF2B5447521FA6EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 f5c95e919b4ffa1ac71049cd45b9f986d2965e6888395ca2806337985334fa56
- MD5 f7b785e9d2d7a4ebd6374a555063a100
- SHA1 da162478b19b05fedc9d8027bd182f6beeecdeda
- SHA512 a287e97b14d1f66783e35f295dc0f355a1da1215aa514d307a01d31b12dd29cc4e9f591281ed6b4f9d8fc90fe7d647ae7d2ef0ad2c989c9dae2123462006776d
- SSDEEP 49152:7MaW1H1ZcPsk9HOJLjJP73tSjPM2gjg9aIhR46LUbOWHHJdsCIdkTYoHjnTVyNMx:0cPsguxj34bwmvD3emt3Dnkr
- TLSH
  T148269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 6af17f483f97ca18b579da8475855469dde1b69b7e7872cae13bcbacc2d33200
- MD5 49fe36c36f9d6e816dc20bed1817f01b
- SHA1 c7e14db7a7436268f09a439683d8955a2f898c3b
- SHA512 cb0049b2a02891200bd7d552d0beb60e2661259b293942bfeabd92f90701dfd101ad14b7f74723bf984ae26c2a584e2dfcb3cbc4f60cbbe0afbafb82273576b1
- SSDEEP 393216:CTnPNWv6krpad1ue1hvp4QdQFygqJ/DVi5wFj4:1advHp4SQjqVDSg4
- TLSH
  T1734729122646D49CC099C879C7678B268A6C30E73FA7B9EFC0F451212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  electron_wer.dll
- Size 415KB
- SHA256 234b9aba3c2c5bb545dedb26783692ec90313a3e17a532ae7c514f8058adf117
- MD5 2f239082cff4b1d0b5fc66b559a3bd7c
- SHA1 6f643de2a752aa49a892757e66a4571cbf5932ba
- SHA512 abbc55b35e94c33017e8dab1c8a503da3c5c72760e8767631cc156fad320d63ea704e9e8c46ac78691a6aad2c357473d796a49dc2ac688f3174c1420c97745e0
- SSDEEP 6144:0jYlWCwLC9fw6oCh7eU5BkNICuvIHvK6vHuyqkC6hMascq:ufC99o6oCh7jnkNICuvIHvWyjC
- TLSH
  T1D4948E04F7D448F8E07BD0388A278642EF71789A0F61E6DF03A456692F37BE45A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 cdf2b70f0f0a97c9840af1466dd86a90e564c98f6892d783635cf9c3b303d613
- MD5 d8d488ec2c3c99ecb9a1dd1b7e6133c3
- SHA1 e991bcef296217721e38c25e5a7d417d6a49f5d8
- SHA512 5f58559ca805c07a4041ff73cb369462bc1e694643ce3fc62b115711cf6b4aee97a927ed888ced67a25b72e8262ee757b69fe23adf693991ce1760cca91a23d3
- SSDEEP 49152:fjAmYvxRVRNqC/2t7Z+3/6TiD7NyzuCPKgc5mar9Yhp1EY2SDqk3hpygdiJyy1Nt:8LRVut7Z+3/o2Whi3
- TLSH
  T13BE5AD03F2E651E9D019C43497AF9323B674780A8F1099EF17905A252F67FE86D3E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 00d703c0557b54edf35c284b15cb0063de1653edef71d33c698a64d2e74073c9
- MD5 98642220caa57916f52465ed7e94cd24
- SHA1 adc9c96a2c4106731f4478d9ca8563e6069dc444
- SHA512 0ea31c78a854ea204cf4aeddea46551f74c8f123bbf991dd67682f613e8d6806d2cbbf0f9e87799a479c3ebd40348935af26e841790e441f33ee255014b9fc8d
- SSDEEP 49152:DmSJKWEgDtaN8gXCoqqW0QtP6pe5RRKc96dXi1TifpAVvH+hMp8e7pMAqqAzHj5Y:DnKWEcHdUIG5wFFLv2
- TLSH
  T18F464903F28581E9D06DD579875BA623F672F8840B22B7CF56A00F192E66FE0A73D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 0802c28ebf8226fccaef45fc44b528873eb4814f714a817b01cc2f6ab49c24da
- MD5 cf41ff11a8a13770f1e4b332a76f01ee
- SHA1 d288d5b650ecc5c44d2f046e69c69c01eebcdaf2
- SHA512 e35c7574d532efc369ddb99a417e8d1432c83110058657ccb4204f88bf3e97002269e753643bfc2fb62a62ad9dc0c3ac75aaf197e18e1eb6bddad717a24b6484
- SSDEEP 24576:PgWZPASFfqoy6Cko/hHMDTCyXbKNlC1E+Dkw7+Dv6g3v0TAE7yoeHbP:PgUPFyoyf/hHM/CyrKNlC1E+Dkw7+Dv9
- TLSH
  T162157D53D5948AB9DA7B8078CCD5490389F174A11722B6CF02B807142F5BFF46BBDB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Deletes itself

Executes dropped EXE

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17