f8665e2594e363b3bf3d6183e0909cb2d1226206bb24003b3f0dbb998240bd09

Sharing

Copy URL Twitter E-mail

General

Target
FC.MOD.MANAGER.zip
Size 154.5MB
Sample261110-239pdsst5k
SHA256 f8665e2594e363b3bf3d6183e0909cb2d1226206bb24003b3f0dbb998240bd09
MD5 eeaff27663e615502bead0212bc8545e
SHA1 69fa0278fe1053e334df0b4cdefcbadcf4c2ff71
SHA512 39c725c2a18b1c596e4b79969eba7d5d5bc6c73175d05476df2cf96d48a2019b3306393e583481c0ac588f23dff7a10f3f9144d8cab25ad8d6fdfc7cadb8d902
SSDEEP 3145728:j7y4IYX0wTGKM7LyVsiZZzC01r2qCV7eZ6J2L6y1Vp6t4MFW:S1smyVdeeiAZZzN6xFW
TLSH
T1EF78338191CD195FC9772CF3234A80D3F18A3AEC8F887D4A48B92BE7D459DD764B2614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  FC.MOD.MANAGER.exe
- Size 111.5MB
- SHA256 f348286cd59572dcd73540946eac43b7075a3630a84a3ab7fdbb14feeeec8a25
- MD5 f578115be214292cbf3dfd984a06581b
- SHA1 5d39fceda06d35d6fa8c3282123eb923ab6c3771
- SHA512 198e33137379a18c25eca05a4b38d4454a3ab1e2852d6c9c3be08bf981a877e3246336b79bffd7ee90599fb012eece0e7e47a5b7bb557012bbd5d52c40266af0
- SSDEEP 1572864:1Pp36F/iKRz/o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZT:1PpIl/heuXpX/z/5NivOcC7hlTrl
- TLSH
  T1B448F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  GameAssembly.dll
- Size 65.5MB
- SHA256 bd863234bd4841761ff322e0daec2f729647fbf196c7f1e970e60165abb6b84a
- MD5 caa5feb6f22d4cfbc7c18674560e0542
- SHA1 a620d6c3219f598d444c20e5032fca0c6e2b4677
- SHA512 35ce8e7cdb6ad487c8a34770e95e2dfab84826cfa38763be20e69c1c78b2665699183937f9aefa58d8e3557f459c160bcae72df6b1f419ac5926aede029672ea
- SSDEEP 393216:qj+gkwz11+fcecpxHvOrejQ34LvGNGRfx/MfAZ8aT/PIRojvOF6FrXvFskGo8g4g:wQCT/PIRav/58g4Ed0jsgGpZnXt
- TLSH
  T1A2E7284ABB758448C4AEE1389A23149FDBB13C445F2467CB24904B9D5F737E8A87BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  RuntimeInitializeOnLoads.json
- Size 5KB
- SHA256 cedc61421faa299a542c2dba278e91046e4448b05331b3799c85347583b3d5ee
- MD5 a4a8307ad8937e651df74436a775800d
- SHA1 685b8ca8b682d9f25a55c3e5efe536cbabb9f025
- SHA512 91b88f97d063b47b7afcf5f19dc5781feeb4067b39d1fcfb3446a5a4941e62dc66e5f7d0d6baacd7fc7da65d4da894101bfe5394d3db6fa3e20e7733d4041995
- SSDEEP 96:b4hZxh5E5E/m3mZtm/m3mZtmbm3mZRgm3mZtmIm3mntm6uliO7xuOu9MEV54avaF:b4Z56Qm3mZtm/m3mZtmbm3mZRgm3mZtQ
- TLSH
  T1CFC129AC3386CF7F5F8BC39679BA1A4D30A40A0F9ACB5C00D8BC1E2F9572245594A16D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  XCurl.dll
- Size 194KB
- SHA256 cecde38e28c879f10da5dd970208f636de383e244e9039cfc68f4bc122a8dea0
- MD5 89def0ca5a57e0c496b72db627861a83
- SHA1 6159b6f780d5fd1e379f3e1719920e855892a04d
- SHA512 9524965733f3ec1c2b4d1a68862cd5f5019d69eaf3305b848b5157ce18e26f3ba90a1e948bdb3eab65fde1a40527284be1695c1121b07806ba861bdf85662c75
- SSDEEP 3072:d8Wm7IMO11wyzl3qttsJnw7yzt20z4hcrxfRY7h86pjWJl8K:WW1Rzl3qttkUy97+xjWJ
- TLSH
  T111147C2666A410B5C1F78274C9A54617FFF2B1892B3053CF06B097691F533A1FA3A72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  assetpreview.dll
- Size 46.3MB
- SHA256 d6ba6a61fb521a83196fcd302614ba5e116b58989ff36f4c8a5519402fc41a56
- MD5 839fb81514b866af3e8f23c4ef9632c3
- SHA1 6eb7b34de12e972f32e517541c26e43dcf6bf534
- SHA512 1fb68d861c6ce5a8a387f10376bcd0cd34d3164dbf1966cc82143ad0fd899035cb48785a681119d509a62d899c84cbfaf08803668e9ef56a922dd7328959e903
- SSDEEP 393216:Fb5/g1I0bjsMw52YLVzrXiPZB4I/CVhzxOwBrFosiXUxpWJ9IWlY3IDUl2nogg9L:fGbQVBxOWco
- TLSH
  T199B73943A6AB44C5F9F79F3498F7525796B7BD057F30818F22141B2A8E337E08962722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  embree3.dll
- Size 21.0MB
- SHA256 903b3c680ffbf2965d7988f0a42d902c5e198cab15c435ddea79852573be3620
- MD5 666d3897c4122e7ce960d626298dc5ad
- SHA1 bc499749a83cd7cd52673ecaa1c74760a20ba714
- SHA512 e6700676448f97f339d2b997c38f8fe4927c2cbc5c2b12d3b8fa298d85c1b4f7aa2e2641375d7205266f70bbd2aa36eb840cf6ef70cdb31102c93c0f5f827964
- SSDEEP 196608:FqXtG6if9bvKrGgjpMZLtAluz3tFN1sgrAVmhy:0t+biras
- TLSH
  T1A5277DA219DC12C9D43684706A2FF696BD1134998F9A0DF3B1D40D88BF517637FFAA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  libcurl.dll
- Size 12.9MB
- SHA256 f6b09f28fd6ec3d77db4888c54d14bba082b1be33d66bd628a137d554190a650
- MD5 78ad3a7a2ff80e39dc340c45a61ea875
- SHA1 d57ace9e3d82dcddaa3bbd820a4618def462f0f3
- SHA512 d29ccf5904fc73b7a6918ccc2230f5bd95151bbecb1099a3fd8b9af26cf20a5b24a9c224a755a1725f51695f03a8e5bc813f0779d6d07cd9d44739b399ab1b8e
- SSDEEP 49152:22jWluN13UCTqd5Z0ok38+/8saU6FHUWBywYAtsZSBcRMjhMQ2y4MzjA8:226vHZ0o6RaUEt7TaI
- TLSH
  T19AD6BA6AEC165562E03946F3C8B0016B93B82CCEF82C5E6139555A725FFF4690C923BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
behavioral12 behavioral13
- Target
  sharedassets9.assets.resS
- Size 23.7MB
- SHA256 ce61cdeaaaec6c7fc42e92e71a3beb76944194d2f74f2bd1af9852211e327ba2
- MD5 0680120ac017821768481003d904f416
- SHA1 0a338f60f9c293ba78067681a1c976554d5884b1
- SHA512 fc1181c155cccf9b6b2c2c270a1d6a0dabb9e85dd1d975bf96e2714edaac14007837a526c7b25c1ece458c437925449f399141088f47251761cf1335b42cc640
- SSDEEP 393216:MBCtJ1YIjRXzaSFBCtavLMw85PJSFBCtavqw4+/PSFBCtavh9h+5aS:Nthlzahtav4nPJhtavH5/PhtavXY5a
- TLSH
  T18D47D0750224D4FAC34EF7B217348AF6F4E479208B45626C12312CEB679FA957A90FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  winmm.dll
- Size 32.1MB
- SHA256 656e09355d30d7ba5b8cf18c5bd86ce3322d247c334fe522bda184001a33d430
- MD5 579999735522b164ce7954cfccb5f6c0
- SHA1 d7194b0dae7469d7ebfba4b7ace400b165e1ecb8
- SHA512 e0f45feb77f69faf7d64c5aac403429da47902c5007e850c77f75aeccec65a1c336d89c79c039bd2542a81337871fb3cab25b1e0628f307232c3dbc68aa6ff3e
- SSDEEP 393216:XJp704U4xdTJ4SJe5d461eLRvZ1X1ALiP6onSMjV06:XUOuLALjV06
- TLSH
  T1AA779C56A2B950D8D47BD038D75BA91BEBB1344503308ADB62E14AA56F33FF02A7F710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17