General
- Target dotmd-0.2.0-windows-arm64-installer.exe
- Size 5.4MB
- Sample261110-n2bjbasxfw
- SHA256 7bca47068b83b5a49e55b839893f93e75b00544e0d3186464367b6281373d760
Score
7/10
Malware Config
Targets
-
- Target dotmd-0.2.0-windows-arm64-installer.exe
- Size 5.4MB
- SHA256 7bca47068b83b5a49e55b839893f93e75b00544e0d3186464367b6281373d760
Score7/10Loads dropped DLL
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 32KB
- SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target dotmd.exe
- Size 9.5MB
- SHA256 67e808fd6425acb2107de33cf1a4ed7c9c7507e906bfa6b1dcecd38e2dd9edf4
Score1/10 -
- Target uninstall.exe
- Size 110KB
- SHA256 735ca9f54f7b3c836c8558ade97372bcabd443bd08a95b4e07378e7ca686ca31
Score7/10Deletes itself
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Direct Volume Access
1Indicator Removal
1File Deletion
1Modify Registry
1