General
- Target MKW-Eglantine-2.1.0.zip
- Size 105.6MB
- Sample261104-xd5xpaez8k
- SHA256 35b9719885423b63b56d1e442c48748b41ab055d2a101507d065d9450b0da5ca
Malware Config
Targets
-
- Target MKW Launcher.exe
- Size 77.0MB
- SHA256 4e353c29e1181d34746cf152514e39fb31156e7b5d7ef4623742ff3fd898cbac
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target Qt6Charts.dll
- Size 1.7MB
- SHA256 14e226e2955854608e5a38c5718b654ab5b4916862f347d74446215a8a1c32ba
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Core.dll
- Size 5.9MB
- SHA256 0cc62e841959fb8f6d366ea116c6f6bbc273e30f0ef90d8aa2e4adeb81fd63f8
Score1/10 -
- Target Qt6Gui.dll
- Size 8.9MB
- SHA256 ca9f20d9b59d5bc321a87005b926b853ebcd6a2394823e14d3c8b5fc5702fa8c
Score1/10 -
- Target Qt6Network.dll
- Size 1.7MB
- SHA256 2c2f65c70989646f06d668883c031f06fac3f8de1f459278c94cc50dfe89988d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6OpenGL.dll
- Size 1.9MB
- SHA256 85fdcd74cd4a8f6a25a0a4adc7f1e83a1a6e7c17f85b4aec06ad0c80bf827a50
Score1/10 -
- Target Qt6OpenGLWidgets.dll
- Size 62KB
- SHA256 c1b46e207730148e7193a2212d3694e86af690fb902687cbf5c33562eec76101
Score1/10 -
- Target Qt6Svg.dll
- Size 516KB
- SHA256 efaf94c5c757a430ec5b89fc209089b14171b5cce945db961c32264f1cc99f80
Score1/10 -
- Target Qt6Widgets.dll
- Size 6.2MB
- SHA256 d34ef78b3d3b5506ee8279ce6efbfc263d773b74860af76e66b0715346897a3a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
Score1/10 -
- Target dxcompiler.dll
- Size 13.7MB
- SHA256 b855ee494c60a5dd0638d4574bc4d728c87fac5d415b9be3122058b5adefda77
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dxil.dll
- Size 1.4MB
- SHA256 2ae215743ca9c9c5ccfe4d53856e582c234a300a3186fc987c1d2bbe0738c50a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target generic/qtuiotouchplugin.dll
- Size 99KB
- SHA256 8e123c011d13ddf884d33f6fba50182d6525a3a7504b7eac0788ef45ab2f2cb1
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target iconengines/qsvgicon.dll
- Size 75KB
- SHA256 6418cb7f188af89fc6876059692d3940377a80bbdb55d70ab907406b46f671d0
Score1/10 -
- Target imageformats/qgif.dll
- Size 46KB
- SHA256 0ee32e5b48bf1404532842862045c523e0c915f223e34ea900c709e7c72b0b1e
Score1/10 -
- Target imageformats/qico.dll
- Size 45KB
- SHA256 30b344703bccbf4bf70809cb9b6ce0075b74bdc765d18e539339190b095bb552
Score1/10 -
- Target imageformats/qjpeg.dll
- Size 562KB
- SHA256 1c3f3996b18b9a6d3f2690ef333843c9195bec2a4eb08f6e68a3b3bc7f097c32
Score1/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1