General

  • Target

    New Order Shipment No.00187.exe

  • Size

    33KB

  • Sample

    210419-1v2l75k76e

  • MD5

    7ae5b36bc9bd69a8323a1b0d0f9fe9ad

  • SHA1

    78917f008a7c2e96e183a6194081b1e719839602

  • SHA256

    32e4914c308b62fe328d5cf926d70002bce706e0ab87c33c9889c7f125a0c309

  • SHA512

    7265eaeaf31f1d2bc734b364d09dd238a8cf559db056814ab3b5fc2a4ae05b5c5ec5eac1bae489fefac83d60ed32c58dc1337b4c0d60daada6d1ffc669c08432

Malware Config

Targets

    • Target

      New Order Shipment No.00187.exe

    • Size

      33KB

    • MD5

      7ae5b36bc9bd69a8323a1b0d0f9fe9ad

    • SHA1

      78917f008a7c2e96e183a6194081b1e719839602

    • SHA256

      32e4914c308b62fe328d5cf926d70002bce706e0ab87c33c9889c7f125a0c309

    • SHA512

      7265eaeaf31f1d2bc734b364d09dd238a8cf559db056814ab3b5fc2a4ae05b5c5ec5eac1bae489fefac83d60ed32c58dc1337b4c0d60daada6d1ffc669c08432

    • Windows security bypass

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks