Resubmissions

12-09-2021 07:23

210912-h76zhscbc3 10

12-09-2021 07:04

210912-hwe2nafbaq 10

General

  • Target

    Setup.exe

  • Size

    10.1MB

  • Sample

    210912-hwe2nafbaq

  • MD5

    32d11c996b67786686172b4179c6ee46

  • SHA1

    d99662924b9d260872bba995b233332ee0eab748

  • SHA256

    1d364c185082bf798f4ff21f33b63c84cc1407ca33be17793990190b59d2042c

  • SHA512

    5dd02bf6a325befea5ce450b453376bee609b03df562fafdf6603b9e6c84e534e5d13b42aaacf0a99f0ffdc767d529c63fd073c6cf76e193f6268fb54ce8276b

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      10.1MB

    • MD5

      32d11c996b67786686172b4179c6ee46

    • SHA1

      d99662924b9d260872bba995b233332ee0eab748

    • SHA256

      1d364c185082bf798f4ff21f33b63c84cc1407ca33be17793990190b59d2042c

    • SHA512

      5dd02bf6a325befea5ce450b453376bee609b03df562fafdf6603b9e6c84e534e5d13b42aaacf0a99f0ffdc767d529c63fd073c6cf76e193f6268fb54ce8276b

    • Registers COM server for autorun

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks