General

  • Target

    tracker.doc

  • Size

    211KB

  • Sample

    200709-2mcg5ntyzs

  • MD5

    9c78815dce144b8ee97f952d3e8c106b

  • SHA1

    2c4b4d224c4577a5c513baaa9318b5b2d962b483

  • SHA256

    be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662

  • SHA512

    740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565

Score
8/10

Malware Config

Targets

    • Target

      tracker.doc

    • Size

      211KB

    • MD5

      9c78815dce144b8ee97f952d3e8c106b

    • SHA1

      2c4b4d224c4577a5c513baaa9318b5b2d962b483

    • SHA256

      be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662

    • SHA512

      740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565

    Score
    8/10
    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run entry to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks