Overview

overview

9

Static

static

8

Disburseme...26.exe

windows10-2004-x64

9

Disburseme...26.exe

windows11-ltsc_2024-x64

9

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-ltsc_2024-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-ltsc_2024-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-ltsc_2024-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-ltsc_2024-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-ltsc_2024-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-ltsc_2024-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-ltsc_2024-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-ltsc_2024-x64

1

Resubmissions

02/11/2026, 19:05

261102-xrgf9agb529

02/11/2026, 18:17

261102-wxfapsfh569

Sharing

Copy URL Twitter E-mail

General

  • Target
    Disbursement_DocRev__2026.exe
  • Size 18.3MB
  • Sample261102-wxfapsfh56
  • SHA256 0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
backdoordefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationratrevoked_codesignspywaretrojan

Malware Config

Targets

    • Target
      Disbursement_DocRev__2026.exe
    • Size 18.3MB
    • SHA256 0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Looks for VMWare Tools registry key

      defense_evasion

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Modifies Windows Firewall

      defense_evasion

    • DattoRMM remote administration tool

      DattoRMM is a remote administration tool that can be used as a backdoor

      backdoorrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/FindProcDLL.dll
    • Size 31KB
    • SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 14KB
    • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/SimpleFC.dll
    • Size 175KB
    • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/SimpleSC.dll
    • Size 61KB
    • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsSCM.dll
    • Size 5KB
    • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/nsisXML.dll
    • Size 11KB
    • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      AxInterop.MSTSCLib.dll
    • Size 240KB
    • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      AxInterop.ViewerX.dll
    • Size 40KB
    • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      CagService.exe
    • Size 19KB
    • SHA256 5aebcbd72f6a969dd2b3c3a79457736a5b21742918611382ace2c16d8d79936d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      Common.dll
    • Size 16KB
    • SHA256 9fccb4772a94e5dfd00a11ff7e7691c902efaecd2cb42789fd9a0da5fb999260
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      Core.XmlSerializers.dll
    • Size 10.6MB
    • SHA256 0ccdac090d53788db358e8ef5c7d6957150bd79f5de45ef1aba319c037e68845
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Core.dll
    • Size 2.3MB
    • SHA256 b5cc9ff42d0560cb4fa7e851a56b949e337400a735a038c94260092bd4a1e546
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      CsExec.Service.exe
    • Size 17KB
    • SHA256 0b738c9bc00b4604fd49ca7763e0c6a7f6cc0c7cf5533e2ead2d806f89bbf29b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

revoked_codesigninstallerbackdoorrat
Score
8/10

behavioral1

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan
Score
9/10

behavioral2

backdoordefense_evasiondiscoverypersistenceprivilege_escalationratspywaretrojan
Score
9/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10