General

  • Target

    19CC436851674447FEB94044399159F2.exe

  • Size

    1.1MB

  • Sample

    210723-7vcfyk79p6

  • MD5

    19cc436851674447feb94044399159f2

  • SHA1

    e21a6a9286ea4f9a7eeb403804eead0342fd5645

  • SHA256

    2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96

  • SHA512

    c53316dca633d00032dad71c28473856131198e8d9019364c4f34dcef1dc39d19e722777df2b465a01f632f4b112e306ebd1a3689377f377f5665cd61e86212a

Malware Config

Targets

    • Target

      19CC436851674447FEB94044399159F2.exe

    • Size

      1.1MB

    • MD5

      19cc436851674447feb94044399159f2

    • SHA1

      e21a6a9286ea4f9a7eeb403804eead0342fd5645

    • SHA256

      2b49d6c607ec59ab95f8473169f8673b7d6772252092e1ce2ecb9b63d2255b96

    • SHA512

      c53316dca633d00032dad71c28473856131198e8d9019364c4f34dcef1dc39d19e722777df2b465a01f632f4b112e306ebd1a3689377f377f5665cd61e86212a

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks