General

  • Target

    DOC.exe

  • Size

    801KB

  • Sample

    200711-361bessdb6

  • MD5

    fe2c7229891329bd1590ab1ce9a50bb1

  • SHA1

    e3165b722ced95332f8d8356002f200d6b9f71a3

  • SHA256

    5bf4fbef77c2b3d4a07c3339b4dd439a3cd08f817361c975958061243e002668

  • SHA512

    96a49fc36f153842dc937cbe6ebe81abfd228ae79e5587696599c2a5fbf5a00a606416bfde6063e75c531471ec787d8ba4d082204b2962afbaff8f5f208b8909

Score
7/10

Malware Config

Targets

    • Target

      DOC.exe

    • Size

      801KB

    • MD5

      fe2c7229891329bd1590ab1ce9a50bb1

    • SHA1

      e3165b722ced95332f8d8356002f200d6b9f71a3

    • SHA256

      5bf4fbef77c2b3d4a07c3339b4dd439a3cd08f817361c975958061243e002668

    • SHA512

      96a49fc36f153842dc937cbe6ebe81abfd228ae79e5587696599c2a5fbf5a00a606416bfde6063e75c531471ec787d8ba4d082204b2962afbaff8f5f208b8909

    Score
    7/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run entry to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Tasks