General

  • Target

    New Order Shipment No.00187.ace

  • Size

    12KB

  • Sample

    210419-2eaczmt6va

  • MD5

    bbb71f850bcf7d8cf8f771d1570c902a

  • SHA1

    5b6edcd88f55e2efc9aebb304c65389c08423965

  • SHA256

    6d73f4042289d32c55906a9aa6cd665f6efea734afcfb9f24b01b07921f60332

  • SHA512

    8e488537f4a4041962f1805e53cdc8e09b5ad272c6ed8758d09f375574e8781ccc6e4744f62137e19540a567cb79d8941808530e9e8e6740e3d20a3b0cfd0ac8

Malware Config

Targets

    • Target

      New Order Shipment No.00187.exe

    • Size

      33KB

    • MD5

      7ae5b36bc9bd69a8323a1b0d0f9fe9ad

    • SHA1

      78917f008a7c2e96e183a6194081b1e719839602

    • SHA256

      32e4914c308b62fe328d5cf926d70002bce706e0ab87c33c9889c7f125a0c309

    • SHA512

      7265eaeaf31f1d2bc734b364d09dd238a8cf559db056814ab3b5fc2a4ae05b5c5ec5eac1bae489fefac83d60ed32c58dc1337b4c0d60daada6d1ffc669c08432

    • Windows security bypass

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks