General

  • Target

    usfive_20210718-120139

  • Size

    472KB

  • Sample

    210718-cr1pearg9e

  • MD5

    18cd767dddb2c001c1c63412f57265f6

  • SHA1

    850e3f4c8acee7093cffa375f782534600476564

  • SHA256

    156376c86635ab2c4156042836fabbd8245038ed7976d8eff0a1f2b297ab4a2b

  • SHA512

    ca626fcbbc74f764c8ec5ff3b99e01e99a692ae0bd395345f7f08135c005aee0c68316ffae31754f859e30a36f4b6f52a950b9a877d599402ecce50e5ecacd1b

Malware Config

Targets

    • Target

      usfive_20210718-120139

    • Size

      472KB

    • MD5

      18cd767dddb2c001c1c63412f57265f6

    • SHA1

      850e3f4c8acee7093cffa375f782534600476564

    • SHA256

      156376c86635ab2c4156042836fabbd8245038ed7976d8eff0a1f2b297ab4a2b

    • SHA512

      ca626fcbbc74f764c8ec5ff3b99e01e99a692ae0bd395345f7f08135c005aee0c68316ffae31754f859e30a36f4b6f52a950b9a877d599402ecce50e5ecacd1b

    • DarkVNC

      DarkVNC is a malicious version of the famous VNC software.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • DarkVNC Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks