Overview
overview
10Static
static
3NTS_eTaxIn...df.exe
windows7-x64
10NTS_eTaxIn...df.exe
windows10-2004-x64
8$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3General
-
Target
NTS_eTaxInvoice·pdf.exe
-
Size
489KB
-
Sample
240625-fpqhpsvflp
-
MD5
fa45fc9a0330174313e4e08e31d22181
-
SHA1
ceb0106d1e8709456e8be6f842badbebde62b567
-
SHA256
3b3d77d803a17ea29440f2a306de9cc86b25d9212c84f10752fa524751bf039c
-
SHA512
5939798d1adc2e30f4b53f8e1a2ebe670f2a34b42a6551b24fa0f86f632aeda13dea009489602d4189581cb4bae442d9aecccc3a7020886e560fc07142a61d5b
-
SSDEEP
12288:/qgow9mQ72+RS2x0mcNasY75T3vCVvMWBFbwLkM:x9mg5Sc7kvhFbwT
Static task
static1
Behavioral task
behavioral1
Sample
NTS_eTaxInvoice·pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NTS_eTaxInvoice·pdf.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
NTS_eTaxInvoice·pdf.exe
-
Size
489KB
-
MD5
fa45fc9a0330174313e4e08e31d22181
-
SHA1
ceb0106d1e8709456e8be6f842badbebde62b567
-
SHA256
3b3d77d803a17ea29440f2a306de9cc86b25d9212c84f10752fa524751bf039c
-
SHA512
5939798d1adc2e30f4b53f8e1a2ebe670f2a34b42a6551b24fa0f86f632aeda13dea009489602d4189581cb4bae442d9aecccc3a7020886e560fc07142a61d5b
-
SSDEEP
12288:/qgow9mQ72+RS2x0mcNasY75T3vCVvMWBFbwLkM:x9mg5Sc7kvhFbwT
Score10/10-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
843657eaf7240b695624dcf38bb0eb31
-
SHA1
ca99a44e737fdeaab56f864ce1ef15a57d2eec90
-
SHA256
b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
-
SHA512
7773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3
Score1/10 -
-
-
Target
$PLUGINSDIR/BgImage.dll
-
Size
7KB
-
MD5
a98576f0d6b35b466cb881860977fdbc
-
SHA1
28b3dbbd76f15c876b98dce523100aa3256d193a
-
SHA256
6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
-
SHA512
29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
-
SSDEEP
96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP
Score1/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
2c84faebfda2abe3b16fdf374df4272f
-
SHA1
a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40
-
SHA256
72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
-
SHA512
207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e
-
SSDEEP
96:3ip41CMj95rKhkfL5RkEdKkcxM2DjDf3GE/E9v5E9av+Yx4QndY7ndS27gA:3iujesS4HRE/K5MYxBdqn420
Score3/10 -