General

  • Target

    Setup12.exe

  • Size

    3.0MB

  • Sample

    211023-3en88addfj

  • MD5

    1d0e65c9adccd36e64e17ef283f272e6

  • SHA1

    4f96cd93bb88aa0af573e3e7ad689f753d55a488

  • SHA256

    c92233690bfbe0085091a4d3eaef1c6a3e1da06636144e88933d8c7278587227

  • SHA512

    c0ee10ac49cadf02a6a534a9a28ebe79bc4e6fd9a53d0fa1fc3d80b704a3bf577bda79433d93bb5559205792d12718016203595d324b98ac9e9e93bfae383de1

Malware Config

Targets

    • Target

      Setup12.exe

    • Size

      3.0MB

    • MD5

      1d0e65c9adccd36e64e17ef283f272e6

    • SHA1

      4f96cd93bb88aa0af573e3e7ad689f753d55a488

    • SHA256

      c92233690bfbe0085091a4d3eaef1c6a3e1da06636144e88933d8c7278587227

    • SHA512

      c0ee10ac49cadf02a6a534a9a28ebe79bc4e6fd9a53d0fa1fc3d80b704a3bf577bda79433d93bb5559205792d12718016203595d324b98ac9e9e93bfae383de1

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks