387063f08e1cf63e9ddea8fa74e73e17b56741e78d91d4b4768017ad3ced3306

Sharing

Copy URL Twitter E-mail

General

Target
WonRemote-Agent-Update.exe
Size 28.3MB
Sample261110-1tpgesdw2v
SHA256 387063f08e1cf63e9ddea8fa74e73e17b56741e78d91d4b4768017ad3ced3306
MD5 0d03af8a33df34eba335f7993049db5b
SHA1 571868644a59c192f901a7928d734a9f58abfd31
SHA512 92f36abb1fe79cde31e5e614787b37ea27326c40fa8d41486731cee8b3bf19371d30631cf331a6fb72c1faa2a915acc6acc6d14825a98b5543658e8737eae2b9
SSDEEP 786432:2zMdguwCFqAaYuIWvRyD9uu//nqOXF2h8Nl9NJWn53BG:2QqUFDaYuHADwudWY9NJa5w
TLSH
T1B05733BAE8250687FD73D1318DB6FA47C1E0805CA753052EDC2A626B2FD7FE4A749049
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WonRemote-Agent-Update.exe
- Size 28.3MB
- SHA256 387063f08e1cf63e9ddea8fa74e73e17b56741e78d91d4b4768017ad3ced3306
- MD5 0d03af8a33df34eba335f7993049db5b
- SHA1 571868644a59c192f901a7928d734a9f58abfd31
- SHA512 92f36abb1fe79cde31e5e614787b37ea27326c40fa8d41486731cee8b3bf19371d30631cf331a6fb72c1faa2a915acc6acc6d14825a98b5543658e8737eae2b9
- SSDEEP 786432:2zMdguwCFqAaYuIWvRyD9uu//nqOXF2h8Nl9NJWn53BG:2QqUFDaYuHADwudWY9NJa5w
- TLSH
  T1B05733BAE8250687FD73D1318DB6FA47C1E0805CA753052EDC2A626B2FD7FE4A749049
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/agent-file-update.ps1
- Size 5KB
- SHA256 f438d794bc4222903dab38787b9da1e47fa88c4a39880e87dfb11e0abfafe0c3
- MD5 55174adbb7efe2fce1c2fda8beca0e0a
- SHA1 f404aa7bcbb12619d06c6b212ff5a3d4a848eb80
- SHA512 6de8a142a51eb49d7a221dd5316666faf82ebc6bf7c85d4b0ca6558bb9776f57969d469d89cba272408c136bbaf64564d5641fecdccbe06b117640e6eec08d7e
- SSDEEP 96:wytZy8DaMYjwaLT5iz/giqzha++EIml1lerfxVr4Or4c+u+EajnudYE:wytZtKwaLT5K/giyhBIo1lixVr4OrVeC
- TLSH
  T163B1B70076A5857A0FAF1F1F798545F12E9B40AE414A1B14F4CCC185BF9293C46DF6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/payload/agent-update-health.ps1
- Size 3KB
- SHA256 5cb32edb90d9c0a86bfb2ac09fc372d1feb1c1da18f861cc030447b130b28d71
- MD5 198c40d474220b15fba2e5adaf85d96e
- SHA1 5841adf66dae2d8d852d8ff8053aeb1c6f57f3ab
- SHA512 6c42ffe41b3663a20e8eb2f97b9b7efc6df9a70e6051f7996fc34c0d782e6abcedad3db573ef512a82e0fe6340d960681af77cde2aa200fe7685ba17ab0eb55e
- TLSH
  T1758165193ED4986B190A496AB0D00654FFEE010F076E86F8F8FEC5947FBD518C16E24E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $PLUGINSDIR/payload/agent/index.mjs
- Size 3.7MB
- SHA256 261e8088e299537577378e2564729b62f5d981f11027a6c42231a270897d3162
- MD5 96e616e4c056ff9f371431a2f436a32f
- SHA1 67ece24585aa45f2cfa0815bc949b8333efb8845
- SHA512 6542ddf97e72b8b67522b4a76fe79242cfda1bcd09e0ea2dc1da361edf4ac5e78ed9f2d4e7c2d64903e4d148a783195763d378f6a5a26bb63c467c397d2826c1
- SSDEEP 49152:HRPJxlg1sO0949df5Uuu/pQc0qQWuWBQRFN4zT:R
- TLSH
  T1C206D7496AF710628663B0BD9F5F9005B2389007350DDD68BE9C83E05F89978D6F6FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $PLUGINSDIR/payload/bin/vcruntime140.dll
- Size 120KB
- SHA256 2fa6efc053203460a23d3a25158f227d895d2dadc63acc1a372da97c3a4281c3
- MD5 d1db57f77b5ace5876b20608312f0f4e
- SHA1 0d69c0c189b23c24b14e045c8a842d923a9874e2
- SHA512 2cc1f7e8d90bf0d4afc47e58d8b9e055ebb061a3307095b15cee3691455d874c073fcbfe135411d3fe86742ac7bb6957d85910f34fb70a71a0a6b3ea91fb300a
- SSDEEP 3072:jZG8PNVWuv2eeMesPUkWJ7vZxLUPLlsecbVpMeaxoWDd:jg8PNwuv2e3UkWZvbLUPCecbVe5Si
- TLSH
  T1B6C38D507184C177D8EA90B491BFBA273C794A114BA047CB7FD49C849E38BE1BB3964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/payload/bin/wonremote-poc.exe
- Size 2.7MB
- SHA256 8c86eed6dc6c77ee321e1d66311a9b27e2ddfe26c595e7b348c38a0c829af9c1
- MD5 47994a0f41317b8f9518325cfc26d8e7
- SHA1 9f5ec33da3eec1b13aeb878e34f96796bdf5de22
- SHA512 0a0f7913cc6c2dd26cfd95f461ef9b4b0b7681c25cb4e25b8f3a5f9d05e937f2c28d27095c2a46488f593bab5681a8a30de8278826586ff9a596083d5feedf66
- SSDEEP 49152:huPT1H33eIQr8N2eqdjwV5nVuEWxn2eGSaADxjhJGZM:hYT1HHQMqdU5nV89bGZI2
- TLSH
  T1B7D51A03F721A466CEC240F1DC3AD3795B796D3817F649E37184AA68EA796D03831F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
behavioral15 behavioral16
- Target
  $PLUGINSDIR/payload/manage-agent-firewall.ps1
- Size 1KB
- SHA256 1ee19c1ac53074e46a263f95ed9dce4a060ffbf9c0f8466ff588157a2936c1ec
- MD5 7bfcccc378a84860d66120971b156490
- SHA1 d1583b832cb1ad64915633e5cf7a8bac14e236c8
- SHA512 d360ef632bc09ee91da6f13934f5c13308a669ff5fd7ead522a8a5f7bd906da84c14899a8a3bdec9da75ff6dde059dcb283326f20a068a2005c1bb86e3dc2456
- TLSH
  T1CD11C3122FE0969060D3AB65A4CB265C765F10B7101C4720F4FFA3803F98A39C35C79E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/payload/manage-agent-login-task.ps1
- Size 23KB
- SHA256 ca67b94c34275ca63acf9b8e91187fdffbae05e57b0b893c912582178fb1deae
- MD5 f2985a7e54a39d78bdcf7e0ff3991db5
- SHA1 7170c8a5c4a39eda834dde9e5def3213b27dec6e
- SHA512 2563399844d053f113c722ca36dc19ce43c883e6e4a66310492afb563eb3a9470ffc1e98ae5d8bcad031b77cb4d7fd7379a00b29cdf7972ecdf9049f50e143f0
- SSDEEP 384:TP7XUdDlcNKxvAhkexU9FW1TSXcf46xRDuReewVb1rVjCH6m9b2nimcc5MlB51e1:fXaDlcNKhAhkexU9FW1T0cf46xRDuReJ
- TLSH
  T13BB2B754B5E0A49B96925BABD4C151A43FB9401E802D1B00F0DCC2987FED57ECBEA29F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/payload/runtime/node.exe
- Size 61.3MB
- SHA256 2586a2e32ec1b0188a9ef7b35b41f53d63e3f4f7211d0b79dd7c72ae9a97123c
- MD5 8bd1c62f9b3ca00825c16b8e4b137724
- SHA1 916da6de57e49d98d9f1332310466f5aeb075fa8
- SHA512 231816e317f30a81fa02dc87fd74e1c7034bff0ede4da05ff996d75cd2a7b47773593211b0f3c490be909cc1d7395d5e152ceeb2f71c5c3aff93eb71e413d699
- SSDEEP 393216:Pv8tS2oyWum2c72mRKe+sTStX8dMlQoYgqxrayS7SMf3OSsonAogACeN3ep9oldR:nOSwWuK0j7Ptf4pgPVlcmPF6fa
- TLSH
  T1C4E75B42A7AB0591F9F75F7054F652278537BD066F3181CBB20C1B2A1F732E08A72B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/payload/server/index.mjs
- Size 85KB
- SHA256 42e2cbe497141fd8375d2be7d8b3c85156f06126fcc2e41609fbddffb6683d3c
- MD5 b7597f5b7e796b9106e4d44ea19190b7
- SHA1 9cc9e62e25391eaefa9e6018885a57234f2de482
- SHA512 de4f3867c9091aeb44317c992323111f3257324ab91cd6bd5643da29cce7b31f5ab514c982ef21d73f87bef8ed4e7ec6ecf723efac7fc0560f6a9298a7e3f2ec
- SSDEEP 1536:3oLlqIICglnsVw3s9t0os3t/wcClST0nCAkTHpJvjt1+/2nldT:7u9CtdT
- TLSH
  T1F783940679F320354A63A1782D1B4152773791073589DFD0FEFC8A902FA6528CBAA7ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/payload/update-handoff-broker.ps1
- Size 1KB
- SHA256 f271502d2ea63f2b9d99f5eb52ae489bc595591ede78915a3f6b4b861c3709e3
- MD5 299bccbbff676b3642bc433cc0068756
- SHA1 5d26d8907752d3903f3180ab9e92a1a0541246b1
- SHA512 b235082bfbcf94c0d1a4f469260d55c895a1177fe15fc7d2cfc216d8e9da0275c2d81d21c866bef15dca0e0fb048e515b790fc4e6ab2137a78945ed6abf7dc86
- TLSH
  T10E3103417972A8BC8DFD578BE8C642B1324B202D11099370889D4669ED77B6A8EDF390
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/payload/wonremote-viewer.exe
- Size 6.2MB
- SHA256 d5e30c0dbc77e2e4a105902d4cdb0807a195c3a57fa49357b0068c7d838c325a
- MD5 5e8fa96af46d24fd0504e9610bd315c0
- SHA1 696b0487605c7ea66a7920272dce8fc77ce42f07
- SHA512 c56bd36e8939eb1073c866bb170356bd61213d9a264e3be6e39a334d949cf962e62cf926d53575c5645b27d44d6841cdf460856037087d66c7b608480c01fc5f
- SSDEEP 98304:45/DQTr3A+HTZLfGVztKjdMwnYOvzUox:4xD2vHTVfcUdMjCzU
- TLSH
  T12C665B823F10E0F7C15B4271E42DE33D9EA7D29CAB214AD7D6689A9C6EF47501C036AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/stop-wonremote-processes.ps1
- Size 5KB
- SHA256 b86ef9744ca5a27a3cd861edb1fa7da10ce27150f7005b1151cf492ebeb2e3f0
- MD5 c83b477c297e4386ce4e5271e0545d6a
- SHA1 92739bb6dc90991528c567d8ccfe2afb4d2c105d
- SHA512 365c55b14bf875e8794c8d38e48b1a8020b44c770f71c12b1033ab470d08cd6818005bd0e1f99c80dae8ee277cec223fe237d837100e9f04a3ec2b8b550f363d
- SSDEEP 96:Mq/sktO2hZC2gEZdErgPzo0pqgxlS0gv4Kv53fBwH8qvbNN6K68TZddZ3Y34/hzd:Mq/HJhzgEHErgP4gi0gvDR3fBwcmbNNN
- TLSH
  T163C16314F1AD96FE19CF25A076C665627ED4402B01DA4FB17CFDC1887FA4C28C26AA4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Uses WMI to collect hardware manufacturer information

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30