General

  • Target

    Setup12.exe_

  • Size

    3.0MB

  • Sample

    211024-enfrfadac2

  • MD5

    96c6b5a436880dca627c18da77fb7048

  • SHA1

    c906eb0bd5caad620137a1f83fca4eaba4654022

  • SHA256

    1617312694ff78615ceee4b38553cd2c7f3a0819a94de39e09dcdd3800c1ce1c

  • SHA512

    277fb59ff99fc47e309883f159de5bc1ecbd4d03d19813697bd1bdd995cb48046b7fa62ca4aab337c776acd25c80cbd182466e9783ddd47f2601670736fad454

Malware Config

Targets

    • Target

      Setup12.exe_

    • Size

      3.0MB

    • MD5

      96c6b5a436880dca627c18da77fb7048

    • SHA1

      c906eb0bd5caad620137a1f83fca4eaba4654022

    • SHA256

      1617312694ff78615ceee4b38553cd2c7f3a0819a94de39e09dcdd3800c1ce1c

    • SHA512

      277fb59ff99fc47e309883f159de5bc1ecbd4d03d19813697bd1bdd995cb48046b7fa62ca4aab337c776acd25c80cbd182466e9783ddd47f2601670736fad454

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks